This vulnerability (CWE-943) affects a web application component of BeyondTrust Remote Support and Privileged Remote Access. It arises from insufficient validation of user-supplied input parameters, which may lead to unauthorized access to resources or data beyond the attacker's intended scope. The attacker must be authenticated and possess limited privileges with specific permissions to exploit this issue. The CVSS 4.0 base score is 8.5, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality and security integrity. No patch or remediation level has been published by the vendor as of the data provided.

An authenticated attacker with limited privileges and specific permissions could exploit this vulnerability to access unauthorized resources or data beyond their authorization scope. This could lead to unauthorized disclosure or compromise of sensitive information within the BeyondTrust Remote Support environment. There are no known public exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to accounts with specific permissions that could exploit this vulnerability and monitor for suspicious activity related to unauthorized data access attempts.