This vulnerability (CVE-2026-6280) in Nomysem involves exposure of sensitive information caused by incompatible policies leading to access to functionality not properly constrained by ACLs. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact. The vendor was contacted but did not provide a response or patch. No affected versions are specified beyond 'through 08072026'.

An attacker with low privileges can remotely access sensitive information that should be protected by access control policies. The confidentiality impact is high, but integrity and availability are not affected. This could lead to unauthorized disclosure of sensitive data within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, organizations should review and tighten ACL configurations and monitor for unauthorized access attempts to sensitive functionality as interim measures.