In Mosquitto through 1.4.12, mosquitto.db (aka the persistence file) is world readable, which allows local users to obtain sensitive MQTT topic information.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-9868.json"