Unblu Spark allows an authenticated attacker to read and modify configuration properties of entities that the attacker is not authorized to access, including other users, other accounts, and in the cloud, other customers' accounts. This vulnerability is a classic authorization bypass that can lead to disclosure of sensitive configuration data and unintended alteration of system settings, compromising confidentiality, integrity, and potentially availability. The weakness falls under the CWE‑639 and CWE‑862 classes, indicating missing authorization checks and improper access control for configuration changes. An authenticated session is required and no additional user interaction is needed.

Versions of Unblu Spark from 7.0 through 8.36.1‑hotfix.0 on both on‑premises and cloud deployments are affected. Unblu Cloud customers have already received the fix, while on‑premises deployments require remedial action.

The CVSS score of 8.9 classifies this as high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated remote attacker who has legitimate credentials, possibly compromised or insider. Because no additional privileges or user interaction are needed, exploitation is straightforward once an authenticated session is established, giving the attacker the ability to read sensitive configuration and alter system behavior.