This vulnerability in HKUDS AI-Trader up to commit 74caf996f78dcc0c657df8365c8544678a16e215 allows remote attackers to perform information disclosure via manipulation of the /api/research/agents.csv endpoint in the Research Export component. The exploit does not require privileges or user interaction and has been publicly disclosed. The vendor's patch (commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65) enforces authentication and capability checks, requiring an authenticated agent with the research_exports capability to access the endpoint, thereby mitigating the issue.

An unauthenticated remote attacker can exploit this vulnerability to disclose sensitive information from the /api/research/agents.csv endpoint. This could lead to exposure of potentially sensitive research data. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, low complexity, and lack of required privileges or user interaction, but limited to information disclosure without integrity or availability impact.

A patch is available and recommended. The vendor has fixed the issue by requiring authentication and the research_exports capability for accessing the affected endpoint. Users should apply the patch identified by commit 91a31aac1b0f4dbc6b8bef9f6eff0b7912e0bc65 to remediate this vulnerability. Since the product uses a rolling release approach, ensure the latest updates including this patch are deployed.