A critical information disclosure vulnerability in Autocaliweb allows for the unauthorized exposure of sensitive API keys via debug packs, posing a significant risk to application security.

The application fails to adequately filter sensitive fields within the to_dict() method when serializing configuration for debug packs, leading to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. This vulnerability requires a local user to generate and share the debug pack for the exposure to occur.

The accidental leakage of API keys can lead to unauthorized access to third party services, data breaches, or complete compromise of the Autocaliweb instance. Given the CVSS score of 8.2, this vulnerability represents a high severity risk that could result in severe reputational damage and loss of system integrity if administrative credentials are exposed.

Immediate Action: Update the Autocaliweb installation to version 0.8.3 or later to ensure that sensitive configuration fields are properly filtered from debug exports.

Proactive Monitoring: Review existing debug files and logs for signs of exposure, and rotate any API keys that may have been included in previously generated debug packs.

Compensating Controls: Restrict access to the debug generation functionality and ensure that generated debug packs are handled with the same security requirements as plaintext credentials.

Public Exploit Available: Unknown.

Organizations utilizing Autocaliweb must prioritize updating to version 0.8.3 immediately to prevent further exposure of sensitive configuration data. Furthermore, administrators should audit all existing debug packs and rotate any API keys currently in use to mitigate the risk of previous, undetected exposure.