The flaw is an incorrect access control in the BlogPage.get_entries() component of APSL puput, which permits any unauthenticated user to retrieve private blog entries through multiple pathways such as the main index, tag or category archives, author and date listings, sidebar widgets, or the RSS feed. The consequence is a breach of confidentiality; no code execution, privilege escalation, or denial‑of‑service effects are reported.

APSL puput versions 1.2.1 through 2.2.0 are vulnerable. The issue resides solely in the blog entry handling code and does not affect any other components of the application.

The vulnerability can be exploited simply by sending a standard HTTP request to any of the exposed URLs and does not require authentication, creating a high risk for any individual who can reach the site. The CVSS score of 7.5 indicates a high severity for confidentiality impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so the opportunistic threat profile hinges on the known high impact rather than measurable exploitation activity.