A vulnerability in the click tracking middleware allows unauthenticated attackers to access personal data of newsletter recipients. This occurs because the middleware does not validate the recipient's authentication code if it is omitted from the request. The personal data is embedded in links sent via email, enabling unauthorized data retrieval.