This vulnerability (CVE-2026-40789) affects TMS Amelia versions up to 2.2 and involves unauthenticated sensitive data exposure due to CWE-201 (Insertion of Sensitive Information Into Sent Data). The CVSS 3.1 score is 7.5, indicating high severity, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and impacts confidentiality only (C:H, I:N, A:N). No official patch or remediation level has been published yet, and no known exploits are reported in the wild. The affected versions are not explicitly listed but are described as versions up to 2.2.

An unauthenticated attacker can access sensitive information from affected versions of TMS Amelia (<= 2.2). This compromises confidentiality but does not affect integrity or availability of the system. The exposure of sensitive data could lead to information leakage risks depending on the nature of the data involved.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider restricting network access to the affected service if possible to reduce exposure.