CloudVision CUE EUVD-2026-93954

Requires a valid authenticated session as a low-privileged network user of CloudVision CUE (PR:L - not exploitable by anonymous/unauthenticated attackers). The attacker must reach the CUE file-serving interface and supply/manipulate a direct object reference (CWE-639) pointing to another user's resource. The CVSS 4.0 AT:P metric indicates a specific precondition must hold: the victim's data is transient, so it must actually be present/accessible at the moment of the attack, making exploitation opportunistic rather than reliably repeatable. Limiting factors: authentication is mandatory, the targeted data is transient (narrow exposure window), only confidentiality of another user's data is at risk (no write/modify capability), and affected deployments are CloudVision CUE versions 2021.2.0 through 2026.2.0.

This is a medium-severity information-disclosure issue (vendor CVSS 4.0 base 6.0) that should be triaged as a moderate, not top, priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L) shows the key limiting signals: exploitation requires an already-authenticated low-privileged user (PR:L - NOT a pre-auth flaw) and carries an Attack Requirement (AT:P), meaning success depends on specific, not-always-present conditions rather than being reliably reproducible on demand. The high confidentiality impact (VC:H) is real - another user's transient data can be read - but there is no integrity impact and only low availability impact, and no scope change to other systems. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is NO evidence of active exploitation or weaponization; the SSVC-style read is low automatability (AT:P conditions) with partial technical impact. One signal conflict to note: the input Tag 'Authentication Bypass' contradicts the actual weakness (CWE-639 IDOR / broken authorization requiring a valid authenticated session) - this is an authorization/access-control flaw, not an authentication bypass, and the tag should not drive escalation. Net: a legitimate issue to patch on a normal cycle, not an emergency, absent exploitation telemetry.

An authenticated low-privileged user of a shared CloudVision CUE deployment manipulates an object identifier (e.g., a file or resource reference) in a request to the file-serving interface to retrieve transient data belonging to a different user. Because the required 'specific attack conditions' (AT:P) must line up - such as the target's transient data being present at the time - exploitation is opportunistic rather than reliably on-demand. No public exploit code was identified in the provided data.