CVE-2025-56467 describes an information disclosure vulnerability in the Axis Mobile App version 9.9 by AXIS BANK LIMITED. Attackers with limited privileges can retrieve sensitive information such as account information, balances, and transaction history without providing the UPI PIN. The supplier states this is an intended feature and asserts that the disclosed information is not highly sensitive. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). No patches or fixes have been documented, and no known exploits are reported in the wild.

The vulnerability allows unauthorized access to sensitive financial information without requiring the UPI PIN, potentially compromising user privacy. However, the supplier's assessment suggests the exposed information may not be highly sensitive. There is no indication of impact on data integrity or availability. The CVSS score of 6.5 reflects a medium severity impact primarily due to confidentiality loss.

No official patch or remediation is currently documented. Since the supplier considers the behavior an intended feature and does not classify it as a significant risk, no immediate action is mandated. Users and administrators should monitor vendor communications for any future updates or changes in the app's security posture.