This vulnerability affects the file backend/app/modules/ai/ai_client.py in the AI Provider Configuration Handler component of datadrivenconstruction OpenConstructionERP up to versions 14.8.0 and 14.8.1. An attacker can manipulate an unknown function to cause exposure of a data element to an incorrect session, potentially leaking sensitive information across sessions. The vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 base score of 5.3, indicating medium severity. Public exploit code exists. The issue is fixed by upgrading to version 15.0.0.

The vulnerability allows unauthorized exposure of data elements to incorrect user sessions, potentially leading to information disclosure. This could compromise data confidentiality within affected OpenConstructionERP deployments. The attack can be performed remotely without user interaction, increasing the risk of exploitation. However, no known active exploitation in the wild has been reported.

Upgrade datadrivenconstruction OpenConstructionERP to version 15.0.0 or later to fully remediate this vulnerability. This upgrade is sufficient to resolve the issue. No other mitigation or temporary workaround is indicated.