CVE-2025-4374 is a security flaw in Red Hat Quay where, if an organization uses Quay as a proxy cache, a user or automated process pulling an image that has not yet been mirrored is incorrectly granted 'Admin' permissions on the newly created repository. This improper permission assignment constitutes a privilege escalation vulnerability (CWE-266). The vulnerability has been assigned a CVSS 3.1 score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity. Red Hat has issued security advisories RHBA-2025:8262 and RHBA-2025:8263 providing fixed releases 3.14.2 and 3.13.6 respectively, which resolve this issue.

Exploitation of this vulnerability allows an unauthenticated user or automated process to gain administrative permissions on newly created repositories in Quay when acting as a proxy cache. This could lead to unauthorized modification or disclosure of repository content, impacting confidentiality and integrity. There are no known exploits in the wild at this time.

Red Hat has released fixed versions 3.13.6 and 3.14.2 of Red Hat Quay that address this vulnerability. Users should apply these updates promptly. Before applying these updates, ensure all previously released errata relevant to your system have been applied. Refer to Red Hat's official update instructions at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.