The a+HRD product by aEnrich contains a Missing Authorization vulnerability (CWE-862) identified as CVE-2026-6834. Authenticated remote attackers can exploit this flaw to arbitrarily read database contents through a particular API method without proper authorization checks. The CVSS v4.0 base score is 7.1 (high), reflecting network attack vector, low complexity, no user interaction, and high impact on confidentiality. The vulnerability does not affect integrity or availability. No patch or official remediation guidance has been published by the vendor as of the publication date.

Successful exploitation allows an authenticated attacker to read sensitive database contents arbitrarily, potentially exposing confidential information. The vulnerability impacts confidentiality with high severity but does not affect integrity or availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API method to trusted authenticated users only and monitor for suspicious access patterns related to this API. Avoid granting unnecessary privileges to users to reduce risk.