CVE-2025-25968 describes an improper access control vulnerability in DDSN Interactive cm3 Acora CMS version 10.1.1. An attacker with editor-level privileges can exploit the 'file' parameter by force browsing to access sensitive files such as cm3.xml, which contain system administrator credentials. This bypasses intended access controls, potentially enabling account takeover and privilege escalation. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 6.0, indicating a medium severity. There is no vendor advisory or patch information available at this time.

The vulnerability allows an attacker with editor privileges to bypass access controls and retrieve sensitive information, including system administrator credentials. This can lead to account takeover and privilege escalation, increasing the risk of unauthorized administrative actions and potential system compromise. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability at low to high levels.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level user access to trusted personnel only and monitor for suspicious activity related to file parameter manipulation. Avoid exposing sensitive files through the application interface. Implement additional access control checks if possible.