A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. (CVE-2026-73741)

This vulnerability in HPE Networking Fabric Composer's API permits an authenticated user with low privilege operator rights to access certain system files that should be restricted. The flaw relates to improper access control (CWE-284). The CVSS 3.1 base score is 4.3, reflecting network attack vector, low complexity, low privilege required, no user interaction, unchanged scope, and limited confidentiality impact. No integrity or availability impact is noted. No patch or remediation details are available from the source data.

An attacker with low privilege operator credentials could gain unauthorized read access to some system files, potentially exposing limited sensitive information. The impact is limited to confidentiality and does not affect system integrity or availability. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict operator user privileges and monitor for unauthorized access attempts consistent with the vulnerability.