AntFlow EUVD-2026-66748

No special conditions are required - AntFlow V2.0.0 in its default configuration routes all HTTP requests through JiMuMDCCommonsRequestLoggingFilter.java, which performs header-based identity resolution. An attacker only needs: (1) network access to the AntFlow HTTP endpoint, and (2) knowledge of a valid userid value to impersonate (which may itself be discoverable through information disclosure or enumeration). CVSS PR:N confirms no prior authentication is needed. There is no non-default configuration that triggers the flaw - the filter is the core identity mechanism, not an optional feature. Exploitation is limited to confidentiality impact (read access); whether write operations are also gated solely on this header is not confirmed from available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) is well-calibrated: the vulnerability is network-reachable, requires zero authentication, zero user interaction, and zero complexity - an attacker only needs to send an HTTP request with a crafted header. The impact is limited to confidentiality (C:H) with no integrity or availability loss, which is appropriate given the description focuses on information leakage rather than write operations. However, identity impersonation could implicitly enable downstream integrity actions depending on what authenticated endpoints are exposed; this is unknown from available data. EPSS at 0.14% (4th percentile) suggests low observed exploitation activity, consistent with the product's niche footprint. No KEV listing exists, and no weaponized exploit is confirmed, but a public researcher GitHub write-up exists at the reference URL, providing enough detail for trivial reproduction. This is a genuine high-priority finding for any AntFlow V2.0.0 deployment - the attack is effortless and the impact is full account impersonation.

An unauthenticated external attacker sends an HTTP GET request to a sensitive AntFlow API endpoint (e.g., user profile or workflow data) and sets the userid request header to the known or guessed identifier of a privileged user. The JiMuMDCCommonsRequestLoggingFilter extracts this header value and treats it as the authenticated identity, granting the attacker full read access to that user's data without any password or session credential. The public researcher write-up on GitHub provides sufficient technical detail to reproduce this in minutes against an exposed instance.