The vulnerability exists in the nexent v1.7.5.2 backend service's ElasticSearch interface, specifically the DELETE /{index_name}/documents endpoint. Due to lack of proper authentication and authorization controls and missing validation of the path_or_url parameter, attackers can craft requests that delete arbitrary documents and files. This leads to significant data integrity and availability issues. The CVSS v3.1 score is 9.1, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on integrity and availability.

Successful exploitation results in unauthorized deletion of documents within ElasticSearch indices and corresponding files stored in MinIO, leading to data destruction and denial of service conditions. Confidentiality is not impacted according to the CVSS vector, but integrity and availability are severely affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the vulnerable endpoint and implement external access controls or firewall rules to prevent unauthenticated requests to the DELETE /{index_name}/documents endpoint. Monitor for suspicious deletion activity and consider disabling or isolating the affected service if feasible.