The issue allows remote attackers with read and write privileges for the encrypted repository to obtain potentially sensitive information by modifying the manifest type byte of the repository to indicate it is unencrypted. This is possible because the software does not confirm unencrypted backups with the user.