The screenshot images were served directly by the HTTP server without proper access control. This could allow an unauthenticated user to access screenshots after guessing their filename.
Thanks to Lukas May and Michael Leu for reporting this.
5.15.2Exploitability
AV:NAC:HAT:NPR:LUI:NVulnerable System
VC:LVI:NVA:NSubsequent System
SC:LSI:NSA:N2.3/CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N