This vulnerability is a concurrency issue (race condition) classified under CWE-362 and CWE-488, occurring in the shared IAM Gateway API-key authentication mechanism of Extreme Platform ONE. When high concurrency traffic occurs, the improper synchronization can cause API requests authenticated with one tenant's IAM-issued API key to receive data intended for a different tenant. The flaw was confirmed on ExtremeCloud IQ/XIQ API endpoints and Extreme Platform ONE/Common Services API paths. Other authentication methods such as XIQ-native tokens and OAuth/Bearer JWT tokens are unaffected. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and a scope change with high confidentiality impact but no integrity or availability impact.

The vulnerability can lead to unauthorized disclosure of tenant data by allowing an authenticated API request to intermittently receive response data belonging to another tenant. This compromises confidentiality but does not affect data integrity or availability. The impact is limited to API-key authenticated requests within Extreme Platform ONE and related services. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation level or patch links are provided, organizations using Extreme Platform ONE should monitor vendor communications for updates. There is no indication that other authentication methods require changes. Until a fix is available, consider limiting high-concurrency API traffic or applying compensating controls if feasible.