The vulnerability in Reconmap's API arises from a fallback authorization policy requiring administrator authentication for most endpoints, except for the report preview action in ReportsController.cs, which explicitly allows anonymous access. This previewReport action loads project and linked client organization details based solely on a project ID parameter without any authentication, project membership, or role verification. Since project IDs are auto-incrementing primary keys, an unauthenticated remote attacker can sequentially enumerate valid project IDs and retrieve sensitive engagement and client data. The 404 responses for invalid IDs also reveal which projects exist. This exposure leaks sensitive penetration-testing engagement details and client organization information.

An unauthenticated attacker can access sensitive information about penetration-testing engagements and client organizations stored in Reconmap by enumerating project IDs. This leads to a confidentiality breach of sensitive project descriptions and client data. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or disable the previewReport endpoint or add proper authentication and authorization checks to prevent anonymous access to sensitive project and client information.