The vulnerability (CVE-2026-73405) in Vulnerability-Lookup involves an authorization bypass in the Server-Sent Events (SSE) streaming interface. The SSE endpoint /pubsub/subscribe/<topic> uses a token_required decorator that authenticates solely by matching the X-API-KEY header against user API keys but does not check the user's is_active and is_confirmed status. Since API keys are issued during self-registration before account confirmation, attackers can create accounts and immediately use the API key to access SSE streams intended only for active, confirmed users. This exposes potentially sensitive streaming data, including newly submitted or unmoderated content. The root cause is inconsistent authorization checks between the REST API and SSE interface. The patch enforces that accounts must be active and confirmed to access SSE streams, closing the authorization gap.

The vulnerability allows unauthorized access to SSE streams by inactive or unconfirmed accounts, potentially exposing sensitive or unmoderated data streams that should be restricted. This could lead to information disclosure of data not accessible through the REST API. There is no indication of privilege escalation beyond this data exposure or other impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The described patch requires accounts to be both active and confirmed before permitting access to Pub/Sub streams, aligning SSE authorization with the REST API. Until a patch is applied, restrict or monitor API key issuance and SSE endpoint access to mitigate unauthorized subscription by inactive or unconfirmed accounts.