This flaw stems from improper validation of tokens, allowing an attacker to retrieve data that should be protected. The vulnerability enables disclosure of sensitive information that could include user credentials, configuration settings, or other confidential data. While the description does not explicitly state the attack vector, it is inferred that exploitation requires the attacker to supply a forged or malformed token, suggesting a potential remote or local authentication bypass scenario.

Acronis Cyber Protect 17, on Linux and Windows platforms, including all builds prior to 42587. Customers using versions older than build 42587 are affected.

The CVSS score of 5.9 places this issue in the medium severity range. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The inferred attack vector involves supplying an invalid or replayed token during authentication, which could allow an attacker to read protected data without proper authorization.