This vulnerability affects Intelliants Subrion CMS up to version 4.2.1. It involves improper handling of the 'q' parameter in the /actions.json?action=assign-owner endpoint, which allows remote attackers to disclose sensitive information. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. No official patch or remediation has been provided by the vendor, and the exploit code is publicly available.

An attacker can remotely exploit this vulnerability without any privileges or user interaction to disclose sensitive information from the affected system. This could potentially aid further attacks or reconnaissance but does not directly allow system compromise or denial of service based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is released, consider restricting access to the vulnerable endpoint or implementing compensating controls to limit exposure.