The vulnerability in OpenViking arises because the debug vector scroll and count endpoints enforce only account-level access control, lacking user-level authorization checks. As a result, any authenticated user within an account can query these endpoints to retrieve sensitive data belonging to other co-tenant users. This flaw compromises confidentiality by exposing private user data across the same account boundary.

Authenticated users can access private and sensitive information of other users within the same account without needing elevated privileges. This leads to unauthorized disclosure of confidential data such as private memories, resources, skills, and secret materials, violating user privacy and potentially enabling further attacks or data misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected debug endpoints to trusted users only or disable these endpoints if possible to prevent unauthorized data access.