Nagios XI versions prior to 2024R1.4.2 contain a vulnerability where API keys are exposed to authenticated users without API access privileges when using Neptune themes. This allows such users to view their own or other users' API keys, potentially leading to unauthorized access. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact.