This vulnerability (CVE-2026-6445) in Everpure FlashArray Purity involves improper authorization (CWE-939) in the handling of a custom URL scheme. Specifically, insufficient filtering of certain data paths permits an authenticated user with low privileges to access sensitive information that should be restricted. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 6.5.0 and 6.10.0. No patch or official remediation level has been published by the vendor as of the data provided.

An authenticated user with low privileges can exploit this flaw to gain access to sensitive information that should be protected, potentially leading to unauthorized disclosure of data within the FlashArray environment. The vulnerability impacts confidentiality, integrity, and availability at a high level according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Everpure's advisories for updates. Until a patch is available, restrict access to authenticated users with low privileges and consider additional access controls or network segmentation to limit exposure.