Skip to main content

Authorization Bypass Through User-Controlled Key

CVE-2025-14881

Low
3.8/10

Summary

In versions through 2025.8.2, 2025.9.x through 2025.9.2 and 2025.10.0, multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

  • LOW
  • NETWORK
  • NONE
  • LOW

CWE-639 - Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References

Advisory Timeline

  • Published