openEQUELLA versions before 2026.1 have a vulnerability in the GET /api/userquery/userinfobackup endpoint, which does not perform authentication or authorization checks. This allows an unauthenticated attacker to retrieve personal details such as username, first name, last name, and email address of any user within the same institution by supplying their uniqueId.