Authenticated information disclosure via stale authorization state

Authorization bypass in Lenovo XClarity Controller allows remote authenticated users to read higher-privileged information. The local-authorization path fails to isolate authorization state across adjacent sessions, granting the next lower-privileged login read access associated with the preceding higher-privileged session. Exploitation requires LDAP Authentication Only with Local Authorization mode and a login within one minute after a higher-privileged user logs out; the reported impact is read-only disclosure.