The CVSS 8.6 rating assigned to CVE-2026-73608 is analytically disconnected from its actual risk profile because the vulnerability existed exclusively in unreleased development code. This is not a minor scoring nit — it's a fundamental mismatch between what CVSS measures (severity given exposure) and what actually happened (code that never reached production). The EPSS score of 0.00241 is the honest signal here: the probability of exploitation in the wild is negligible, and for good reason — no production systems run this code.
The 'anonymous reader' framing in the CVE description is also misleading. The endpoint in question requires authentication via CheckAuth — so the vulnerability is not about unauthenticated access at all. It's about an authenticated user who should be restricted by FilterAttributeViewByPublishAccess but can bypass that filter through this specific endpoint. This changes the threat model significantly: you're not dealing with an internet-facing unauthenticated vector, you're dealing with lateral movement or privilege escalation within your authenticated user base. If the description had said 'authenticated user with standard reader permissions can access unpublished rows,' the triage path would have been clearer.
The commit hash 9b8e8956f is more actionable than the CVE number. It tells you exactly what changed, when, and in which branch. Operators who pulled the development branch can audit their history directly. Everyone else — the vast majority of practitioners whose installations never included this code — can disregard the CVE entirely rather than waste analyst hours triaging a phantom vulnerability.
The real problem isn't the scoring methodology. It's that a vulnerability in unreleased code was issued a CVE at all. Every scanner that indexes this CVE will flag it against production systems that are not and never were affected. Security analysts will spend time triaging, escalating, and closing tickets for a vulnerability that never existed in their environment. This creates genuine operational cost — analyst hours consumed by a phantom — which is the actual blast radius of this disclosure. The fix isn't a 'development-only' modifier for CVSS; it's recognizing that code which never ships shouldn't generate CVEs that pollute vulnerability databases and degrade signal-to-noise ratios across the entire ecosystem.