Psono Server CE and EE versions 4.0.33 through 7.2.3 have an authorization bypass vulnerability in deployments using URL_PREFIX. The server incorrectly authorizes POST requests to the bulk-secret-read endpoint with write scope instead of read scope, allowing an authenticated attacker with a write-enabled but read-disabled API key to retrieve encrypted secret data and nonces. Default configurations without URL_PREFIX are not affected.