9.1 CVSS score (low attack complexity, low privilege required, high impact) and barely a mention of it in the official changelog.