This vulnerability in Veeam ONE involves improper authorization checks that permit a user with limited privileges to retrieve report data outside the boundaries defined by a shared report link. The flaw is categorized under CWE-863 (Incorrect Authorization). The CVSS 4.0 base score is 5.3, indicating a medium impact with network attack vector, low attack complexity, no privileges required beyond low privilege, and no user interaction needed. There is no vendor advisory or patch information available at this time, and the product is not a cloud service.

An attacker with low privileges can access report data that should be restricted, potentially exposing sensitive information contained in reports. The impact is limited to unauthorized data disclosure within the Veeam ONE reporting functionality. There is no indication of privilege escalation, denial of service, or code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to shared report links to trusted users only and monitor for unusual access patterns related to report data retrieval.