The vulnerability CVE-2026-50213 affects the Acer Connect M6E 5G Portable WiFi Router and is categorized under CWE-798 (Use of Hard-coded Credentials). The issue arises because the account validation endpoint (/v1/User/validate) returns comprehensive user profile data that can be enumerated by iterating predictable IDs. This allows unauthorized access to sensitive user information without requiring authentication. The CVSS 4.0 score is 8.7, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality. No patch or official remediation guidance has been published by Acer as of the vulnerability's disclosure date.

An attacker can remotely access detailed user profile data from the vulnerable endpoint without authentication by exploiting predictable identification strings. This exposure of sensitive user information can lead to privacy violations and potential further attacks leveraging the disclosed data. The vulnerability does not require user interaction or privileges, increasing its risk. However, no known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published by Acer, users should monitor vendor communications for updates. Until a patch is available, restricting access to the device management interface and disabling remote management features where possible may reduce exposure.