openEQUELLA CVE-2026-66091

No special conditions - remote unauthenticated exploitation against default configurations of openEQUELLA before 2026.1: the GET /api/userquery/userinfobackup endpoint performs no authentication or authorization check, so no credentials, roles, or feature toggles are required. The only practical prerequisites are network reachability to the openEQUELLA API and knowledge or enumeration of a valid target uniqueId; exploitation is limited to users within the same institution and each request discloses a single user's profile fields, so bulk PII collection requires iterating over uniqueId values rather than a single request.

This is a genuine but moderate-severity information-disclosure flaw (CWE-639, IDOR / broken object-level authorization). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 and confirms the attack is network-reachable, low-complexity, requires no authentication (PR:N) and no user interaction - meaning any remote party who can reach the endpoint can abuse it against default deployments. Impact is deliberately narrow: only confidentiality is affected and only at Low (VC:L, VI:N/VA:N), because the leak is limited to one user's stored profile fields (username, first name, last name, email) per request, scoped to the same institution. No EPSS score is provided, so widespread-exploitation probability cannot be quantified; there is NO CISA KEV listing and NO public exploit or PoC reference in the input (the only GitHub link is the vendor security advisory, not exploit code). The vuln.today decision label is 'this_month' - a near-term but non-emergency priority, consistent with a medium-severity confidential-data leak rather than an actively exploited critical. Net: treat as a real patch-this-cycle item (easy to exploit, enumerable PII) but not a drop-everything emergency, since impact is bounded to limited PII and no active exploitation or weaponization is evidenced.

An unauthenticated attacker on a network path to an openEQUELLA instance issues repeated GET requests to /api/userquery/userinfobackup, each supplying a different (or enumerated/guessed) uniqueId belonging to another user in the same institution. Because the endpoint performs no authentication or authorization check, the server returns that user's stored username, first name, last name and email, allowing bulk harvesting of institutional user PII. No public exploit code is identified at time of analysis; the attack is trivial to script given the low complexity and absence of authentication.