This vulnerability (CWE-200) in the Gaudire Assassin game involves the exposure of sensitive information through the API fields 'email' and 'telefon' and also within the local database. An unauthenticated remote attacker can exploit this flaw to access sensitive personal data, including data on minors and municipal users. The vulnerability is rated critical with a CVSS 4.0 score of 9.2, indicating high impact and ease of exploitation. No patch or official remediation has been published yet, and the product is not a cloud service, so remediation depends on vendor action.

Successful exploitation results in unauthorized disclosure of sensitive personal information such as email addresses, phone numbers, and sensitive user categories (minors, municipal users). This could lead to privacy violations and potential misuse of personal data. The vulnerability requires no authentication and no user interaction, increasing the risk of widespread data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users and administrators should monitor vendor communications for updates. Until a fix is released, restricting access to the affected API endpoints and securing the local database to prevent unauthorized access may help reduce exposure risk.