This vulnerability in v3.7.4-alpha.1 exposes a failure mode that recurs across API implementations: authentication without authorization. The endpoint correctly verifies who you are (CheckAuth) but never verifies what you're permitted to access. For a reader-role user, this means supplying any valid avID parameter returns complete view structure — database names, field layouts, icon assignments, and Hidden flags. This isn't a data leak in the traditional sense; it's a schema enumeration vector. One reader account becomes a reconnaissance platform capable of mapping the entire organizational knowledge base.
The fix landed in v3.7.4 stable, but this is a structural vulnerability, not a temporal one. The avID parameter accepts arbitrary identifiers without any ownership declaration at the call site. This is the code smell that has produced identical exposure in API after API — when a resource identifier can be supplied without a corresponding ownership or scope check, you're looking at the same mutation regardless of which developer wrote it or which framework hosts it.
Three things to check and do. First, audit your API endpoints for CheckAuth-only registration: any endpoint that verifies identity but lacks explicit publish-access or scope filtering is a candidate for this class of exposure. Second, examine your routing layer for avID-style parameters that accept arbitrary values without ownership validation — these are the invisible permission boundaries that cause the vulnerability. Third, treat reader-role accounts as high-value targets for your threat model: enumerate what schema-level information they can access, because that's reconnaissance data that enables targeted attacks against higher-privilege accounts.
The pattern is documented, the fix is straightforward (add publish-access filtering to the authorization layer), but the underlying architectural condition — auth substituted for authz — will reproduce in the next feature cycle unless your routing layer structurally forces developers to confront resource-scope boundaries.