CVE-2025-12766 is an authorization bypass vulnerability classified under CWE-639 (Authorization Bypass Through User-Controlled Key) found in BlackBerry AtHoc (OnPrem) version 7.21. The flaw resides in the Management Console of the Interactive Warning System (IWS), where an attacker can manipulate user-controlled keys to access information about other organizations hosted on the same platform. This constitutes an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthorized access to sensitive organizational data without proper authorization checks. The vulnerability requires the attacker to have low-level privileges (PR:L) and network access (AV:N), but no user interaction is needed (UI:N). The scope is changed (S:C), meaning the vulnerability affects resources beyond the attacker’s initial authorization scope. The impact is limited to confidentiality (C:L), with no direct impact on integrity or availability. While no known exploits are currently reported, the vulnerability could be leveraged to gather intelligence on co-hosted organizations, potentially aiding further targeted attacks or espionage. BlackBerry AtHoc is widely used in public safety, emergency management, and critical infrastructure sectors, making this vulnerability particularly sensitive. The lack of published patches necessitates proactive mitigation and monitoring by affected organizations.

For European organizations, especially those in public safety, emergency response, and critical infrastructure sectors, this vulnerability poses a risk of unauthorized disclosure of sensitive information about other organizations sharing the same BlackBerry AtHoc IWS environment. Such information leakage could undermine operational security, reveal organizational structures or alerting protocols, and facilitate subsequent targeted attacks or social engineering campaigns. Given the role of AtHoc in crisis communication, any compromise of confidentiality could erode trust and effectiveness in emergency situations. Although the vulnerability does not directly affect system integrity or availability, the exposure of sensitive data could have significant reputational and operational consequences. The medium severity rating reflects the limited scope of impact but acknowledges the critical nature of the affected systems. European entities relying on BlackBerry AtHoc OnPrem installations should consider the potential for cross-organization data leakage and the implications for compliance with data protection regulations such as GDPR.

1. Conduct a thorough access control audit of the BlackBerry AtHoc Management Console to ensure that user roles and permissions are strictly enforced and that no excessive privileges are granted. 2. Implement network segmentation to isolate the AtHoc Management Console and restrict access to trusted administrative networks only. 3. Monitor logs and access patterns for unusual or unauthorized attempts to access data pertaining to other organizations hosted on the same IWS platform. 4. Engage with BlackBerry support to obtain any available patches or workarounds as soon as they are released. 5. Consider deploying compensating controls such as multi-factor authentication (MFA) for all administrative access to reduce the risk of credential misuse. 6. If possible, segregate organizations into separate IWS instances to minimize the risk of cross-organization data exposure. 7. Train administrators and users on the risks of IDOR vulnerabilities and the importance of secure key management within the platform. 8. Review and update incident response plans to include scenarios involving unauthorized data disclosure from the AtHoc system.