This vulnerability in Veeam ONE involves incorrect authorization (CWE-863) that permits a user with low privileges to retrieve report data outside the boundaries defined by a shared report link. The CVSS 4.0 base score is 5.3, reflecting a network attack vector with low complexity and no user interaction required. The vulnerability does not involve confidentiality, integrity, or availability impacts beyond unauthorized data access. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with low privileges can access report data that should be restricted, potentially leading to unauthorized disclosure of sensitive information contained in reports. There is no indication of further impact such as data modification or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to shared report links to trusted users only and monitor for unusual access patterns related to report data retrieval.