The a+HRD product by aEnrich suffers from a Missing Authorization vulnerability (CWE-862) that permits authenticated remote attackers to arbitrarily read database contents through a particular API method. The CVSS 4.0 base score is 7.1, reflecting network attack vector, low complexity, no user interaction, and high impact on confidentiality. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor action.

An authenticated attacker with legitimate access can exploit this vulnerability to read sensitive database contents without proper authorization checks. This compromises confidentiality of the data stored in the a+HRD system. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user privileges to minimize risk and monitor for suspicious API access patterns related to database reads. No official remediation or temporary fix is currently documented.