This vulnerability in HKUDS AI-Trader up to commit 74caf996f78dcc0c657df8365c8544678a16e215 allows remote attackers to disclose information by manipulating the /api/research/agents.csv endpoint in the Research Export component. The product uses a rolling release model, so specific affected versions are not enumerated. The vendor's patch identified by commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 enforces authentication and capability checks on the research export endpoints, preventing unauthorized access. The CVSS 4.0 base score is 6.9 (medium severity) with network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact.

An attacker can remotely access sensitive information via the research export endpoint without authentication, leading to information disclosure. The vulnerability does not require privileges or user interaction and has a medium severity rating. There is no indication of integrity or availability impact.

A patch is available and recommended. The vendor has implemented access control requiring authenticated agents with the research_exports capability to access the research export endpoints. Applying this patch or update will mitigate the vulnerability. Since the product uses a rolling release approach, users should update to the latest version including commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 or later.