This vulnerability (CVE-2024-8074) affects Nomysoft Informatics Nomysem versions prior to 13.10.2024. It is characterized by missing authentication and authorization controls on a critical function, enabling unauthorized data collection from users. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function) and CWE-862 (Missing Authorization). No patch or fix information is currently available.

An attacker can remotely invoke a critical function without proper authentication or authorization, potentially collecting user-provided data without permission. This can lead to unauthorized data exposure and compromise of confidentiality and integrity within the affected system. The vulnerability's critical severity and high CVSS score reflect the significant risk posed if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Nomysem functions through network controls or other compensating measures where possible.