A remote attacker can trigger the EmportDwr.createExportJSON function by requesting /ScadaBR/export_project.htm, bypassing the existing admin check. The code does not control access to the export operation, allowing data extracted from the system to be sent back to the attacker. This causes sensitive information to be revealed outside authorized channels and is classified as an information‑disclosure defect. The core weakness is an improper authorization check and a privacy failure.

The flaw affects ScadaBR installations through version 1.1, specifically the Export Project Endpoint component. Upgrading to version 1.2.0, which implements the proper Permissions.ensureAdmin() gating on the export operation, removes the vulnerability.

The CVSS score of 6.9 indicates a moderate severity condition. EPSS is not provided, and the flaw is not listed in the CISA KEV catalog, but the vulnerability has already been publicly disclosed and could be exploited by sending crafted requests from almost any remote network. Because the code relies on missing authorization, the attack can succeed without credentials or privileged access, making the threat realistic for adversaries who can discover the exposed endpoint.