This vulnerability in F5 BIG-IP products allows an authenticated user with iControl SOAP access to potentially obtain information from other user accounts due to incorrect privilege assignment. The issue is identified as CWE-266 and affects multiple supported versions of BIG-IP. The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required. Confidentiality impact is high, while integrity and availability impacts are none. No official patch or remediation guidance is currently available, and no exploits have been observed in the wild.

An authenticated user with iControl SOAP access could gain unauthorized access to information from other accounts, potentially leading to confidentiality breaches. There is no impact on system integrity or availability. The vulnerability affects multiple supported versions of F5 BIG-IP but does not apply to versions that have reached End of Technical Support.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, organizations should monitor F5 advisories for updates. Restricting iControl SOAP access to trusted users and minimizing the number of accounts with such privileges may reduce exposure.