tsi-dpdp-cms EUVD-2026-97283

No special conditions beyond reaching the API - remote unauthenticated exploitation against default configurations of tsi-coop tsi-dpdp-cms v0.5.2 and earlier, because the API dispatcher validated the request payload against its JSON schema before performing authentication. The specific prerequisite is the ability to send an HTTP API request containing a valid _func value with required fields omitted; the server then returns a 400 response naming the missing fields. The leak is LIMITED to internal parameter/schema metadata of the admin, DPO and client APIs (field names such as fiduciary_id for job, API-key, operator, and ROPA functions) - it does not expose stored data, tokens, or allow writes. Exploitation is fully neutralized by upgrading to v0.5.3, where authentication runs first and a missing/invalid token returns 401 with no field names.

This is a moderate, not critical, priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms genuinely remote, unauthenticated, low-complexity access with no user interaction, which raises exploitability, but the impact is narrow: only VC:L (low confidentiality), with no integrity or availability impact, matching CWE-200 information disclosure. The vendor-confirmed root cause (schema validation running before authentication) means an attacker only learns internal parameter/schema metadata of admin and DPO APIs - not actual data, credentials, or code execution. Exploit maturity is E:P (proof-of-concept), consistent with the publicly available PoC on GitHub, but there is NO CISA KEV listing and no evidence of active exploitation, so this is a disclosed-and-weaponizable issue rather than a confirmed in-the-wild threat. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in - this is a gap. The signals are internally consistent (unauthenticated network vector + public PoC + low-value information leak), so the realistic risk is primarily as a reconnaissance aid for chaining against other weaknesses, not a standalone high-impact breach.

An unauthenticated remote attacker sends an API request to the tsi-dpdp-cms dispatcher specifying a valid _func (e.g. for the admin, job, API-key, operator or ROPA endpoints) while deliberately omitting required fields. Because the server validated the JSON schema before checking authentication, it returns a 400 error naming each missing field (e.g. required property 'fiduciary_id' not found), letting the attacker reconstruct the internal parameter schema of privileged APIs without credentials. A public proof-of-concept for this technique is available on GitHub, and the low attack complexity (AC:L) means no special timing or conditions are needed.