This vulnerability (CVE-2025-11145) affects enVision software by CBK Soft and is characterized by an observable discrepancy that allows unauthorized actors to gain sensitive information and perform account footprinting. The CVSS 3.1 base score is 7.5, indicating high severity, with attack vector network, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality but not integrity or availability. It is related to CWE-203 (Observable Discrepancy), CWE-200 (Exposure of Sensitive Information), and CWE-359 (Exposure of Private Personal Information). The affected versions are all before 250566. No patch or vendor advisory is currently available.

The vulnerability allows attackers to observe discrepancies in the software's behavior or responses that expose sensitive and private personal information without requiring any privileges or user interaction. This can lead to unauthorized account footprinting, potentially enabling further targeted attacks or privacy violations. There is no reported impact on system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is available, users should monitor for vendor updates and advisories. Until a patch is released, consider limiting exposure of the affected enVision software to untrusted networks if possible.