ArcherySec through version 2.0.6 fails to validate organization ownership in the WebScanVulnList API endpoint. This improper access control vulnerability enables authenticated users to read vulnerability data from other organizations by manipulating scan identifiers. The leaked information includes detailed web vulnerability findings such as titles, severities, statuses, and analyst notes. The CVSS 3.1 base score is 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting a network attack vector with low complexity, requiring low privileges, no user interaction, unchanged scope, and high confidentiality impact.

Authenticated users can access sensitive vulnerability information from other organizations, potentially exposing confidential security assessment data. This breach compromises confidentiality but does not affect data integrity or availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict authenticated user access to trusted parties only and consider additional access controls or network segmentation to limit exposure.