This vulnerability in vanna-ai vanna (up to version 2.0.2) affects an unspecified functionality within the Chat API Endpoint located at /api/vanna/v2/. The flaw results in missing authentication controls, enabling remote attackers to interact with the API without credentials or authorization. The vulnerability is remotely exploitable without user interaction or privileges. The vendor was notified but has not issued any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability.

An attacker can remotely access and manipulate the affected API endpoint without authentication, potentially leading to unauthorized access or actions within the application. The exact impact on confidentiality, integrity, or availability is rated low to low, but the missing authentication exposes the system to unauthorized use. No evidence of active exploitation in the wild is currently known.

Patch status is not yet confirmed — no official fix or vendor advisory has been provided. Users should monitor for vendor updates or advisories. Until a patch is available, consider restricting network access to the vulnerable API endpoint or implementing external authentication controls as a temporary mitigation.