A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low‑privileged user, such as a read‑only or guest administrator, to crash the wgagent process and read arbitrary files that the daemon can access by submitting a specially crafted management API request. The flaw leads to a denial of service and potential information disclosure, representing a missing authorization and improper input handling weakness.

This issue affects WatchGuard Fireware OS. The known vulnerable releases are Fireware OS 12.5.21, Fireware OS 12.12.3, Fireware OS 2026.2.3, and Fireware OS 2026.3.2.

The CVSS score of 7.1 indicates a medium‑to‑high risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting a lower observed exploitation probability. The attack requires an authenticated user with at least low privileges; therefore, an attacker must first gain system access or compromise an existing account before exploiting the flaw. Once authenticated, the attacker can trigger a crash of the wgagent process and access protected files, undermining both availability and confidentiality.