This vulnerability in exo-explore exo 1.0.69 allows an unauthenticated remote attacker to escalate privileges by accessing the GET /state and DELETE /instance/{instance_id} endpoints. The issue stems from missing or inadequate authentication controls, classified under CWE-306 (Missing Authentication for Critical Function). The CVSS v3.1 base score is 7.5, indicating high severity, with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability. No patch or official remediation guidance is currently available.

An attacker can remotely escalate privileges without authentication, potentially allowing unauthorized deletion of instances and access to state information. This can lead to denial of service or disruption of normal operations. There is no indication of confidentiality or integrity compromise, but availability impact is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the affected endpoints and monitor for unauthorized access attempts. Implement additional access controls or authentication proxies if possible.