The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization checks when the target organization is specified using an organization ID. An authenticated user with limited privileges could therefore access CLA signature records containing contributor information that belongs to an organization they are not authorized to administer. This results in the unauthorized disclosure of personal identifying information (PII) about contributors, violating privacy and potentially regulatory requirements. The weakness is a broken access control flaw (CWE-862).

This issue affects the SAP CLA-Assistant component. No specific product versions are listed in the advisory, so all current releases of SAP CLA-Assistant are potentially impacted.

With a CVSS score of 6.5 the vulnerability is classified as medium severity. The EPSS score is not reported, and the vulnerability is not currently listed in the CISA KEV catalog. Attackers would need to authenticate as a user with limited privileges and then manipulate the organization ID parameter in the admin API endpoint. Since the check is not enforced, the attacker can retrieve signature data and associated contributor PII from other organizations. The vulnerability is exploitable without requiring additional system compromise, but it requires possession of an authenticated account.