A vulnerability in maykinmedia's open-object API versions 2.4.3 to before 2.5.1, 3.0.0 to before 3.6.2, 4.0.0-rc.1 to before 4.0.2, and 4.1.0 to before 4.1.1 allows an API token scoped to read one ObjectType to access full versioned records of objects of other ObjectTypes via the history-detail endpoint. This bypasses authorization checks that normally restrict access, potentially exposing sensitive data such as citizen or case records in government deployments. The issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.