A low‑privileged remote attacker can view a list of roles that should only be accessed by administrators in the Bender Customer Platform Software. This results in a low level confidentiality breach; no sensitive personal data is disclosed, but the attacker gains insight into the internal role hierarchy. The weakness is an insufficient access control flaw (CWE‑862).

The vulnerability affects Bender:Customer&Partner, the Bender Customer Platform Software. No specific version range is provided in the advisory, so the entire product should be considered potentially impacted until a vendor update is issued.

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available and it is not listed in the CISA KEV catalog, implying limited evidence of exploitation. The likely attack vector is a remote authenticated user with low privileges able to request the role list endpoint; the attacker does not need to bypass authentication but only to access a page that should be restricted to administrators. The risk remains low to moderate but can aid further attacks through role enumeration.