This vulnerability in migration-planner arises from missing authentication and authorization controls on the DELETE /api/v1/sources API route. An unauthenticated attacker can exploit this flaw to delete all customer-related data, severely impacting the platform's data integrity and availability. The CVSS v3.1 score is 9.1, reflecting the critical severity due to network attack vector, no privileges required, no user interaction, and high impact on integrity and availability. The affected versions are all releases before 0.13.5. No official patch or remediation level is stated in the vendor advisory, and no known exploits in the wild have been reported as of the advisory publication date.

Exploitation leads to complete destruction of customer data including sources, agents, and assessments. This results in a critical loss of data integrity and availability across the entire SaaS platform, potentially causing severe operational disruption and data loss for affected customers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided in the Red Hat advisory, users should monitor the vendor advisory for updates. Until a patch is available, restrict access to the vulnerable API endpoint and implement compensating controls such as network-level restrictions or API gateway authorization to prevent unauthorized DELETE requests to /api/v1/sources.