This ACL bypass in SonLogger warrants a severity reassessment beyond the 7.5 CVSS score. The vulnerability exists in versions 6.6.6 through 6.7.4.8, and the CVSS framing cannot account for the critical factor: SonLogger runs with SYSTEM privileges, which transforms an authorization bypass from a data leak into potential full system compromise. The same vulnerability in a user-level application gets you limited access; in SonLogger, it potentially grants credential harvesting from log streams, audit trail manipulation, and persistence through a privileged context.
The core failure is a recurring pattern in infrastructure software: developers answered 'is this endpoint authenticated' with yes, so the follow-up 'who should be allowed to hit it' was never asked. Logging tools with elevated privileges get ACL bypasses on a remarkably consistent cycle because the mental model is 'collect everything, make it queryable' — not 'this API could allow exfiltration of credential material.' SonLogger aggregates visibility across your entire environment, so a successful exploit doesn't just give you one system's credentials; it gives you the aggregated credential material from every system feeding into that log stream.
The EPSS score of 0.00232 reflects automated, opportunistic exploitation likelihood — which is category-inapt for privileged infrastructure software. Adversaries targeting log aggregation systems aren't running mass scanners; they're conducting reconnaissance-heavy operations where they already know the target runs SonLogger. If your instance is directly internet-adjacent in a regulated environment, this changes the threat calculus significantly.
Check your deployed version immediately. If you're on 6.6.6 through 6.7.4.8, assume credential material accumulated in log streams during the exposure window and rotate sensitive credentials that touched those logs. After patching, verify that the fix doesn't introduce second-order vulnerabilities in the role assignment logic itself — CVE genealogies in logging vendors show a consistent pattern where ACL bypass patches introduce new attack surfaces through default role configurations.