CVE-2026-81531: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in TP-Link System Inc. Omada Software Controller

This vulnerability involves an API endpoint in TP-Link Omada Software Controller that is intended only for initialization but remains accessible afterward. Because it discloses account-related information without authentication, remote attackers can query this endpoint to gather data that may facilitate user enumeration and subsequent attacks on administrative accounts. The affected versions include all versions from 0 up to but not including 6.3.0.45, as well as version 0 itself. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality.

Successful exploitation allows unauthenticated remote attackers to access sensitive account-related information via the exposed API endpoint. This can lead to user enumeration and increase the risk of targeted attacks against administrative accounts. There is no indication of direct system compromise or privilege escalation from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict network access to the affected API endpoint if possible and monitor for unusual access patterns related to this endpoint.