This vulnerability in Frauscher Sensortechnik FDS 102 (version 2.11.0) involves a direct request flaw (CWE-425) where a low-privileged remote attacker can access the /api/user/fetch-all.php endpoint to enumerate all user accounts and identify those with elevated privileges. The CVSS 4.0 base score is 5.3, indicating medium severity. There is no indication of active exploitation in the wild or an official fix at this time.

An attacker with low privileges can remotely enumerate all user accounts and identify which accounts have elevated privileges. This could facilitate further targeted attacks or privilege escalation attempts. However, the vulnerability does not directly allow privilege escalation or code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/user/fetch-all.php endpoint to trusted users only, if possible, and monitor for unusual access patterns related to user enumeration.