CVE-2025-61117: Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 12:55 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
- Developers should urgently implement and deploy patches that enforce strict access control on all user data API endpoints, ensuring authentication tokens cannot be retrieved without proper authorization.
- Introduce multi-factor authentication (MFA) to reduce the risk of account takeover even if tokens are compromised.
- Conduct thorough security audits and penetration testing focused on API endpoint security and token management.
- Users should be advised to update the app immediately once a patch is released and to monitor their accounts for suspicious activity.
- Implement rate limiting and anomaly detection on API endpoints to detect and block suspicious token requests.
- Educate users on recognizing phishing attempts or suspicious communications that might exploit this vulnerability.
- Organizations using the app should consider temporary suspension of its use until a secure version is available, especially in regulated environments.
- Employ encryption and secure storage of authentication tokens on the client side to prevent token theft from the device.
Description
Senza: Keto & Fasting Android App version 2.10.15 (package name com.gl.senza), developed by Paul Itoi, contains an improper access control vulnerability. By exploiting insufficient checks in user data API endpoints, attackers can obtain authentication tokens and perform account takeover. Successful exploitation could result in unauthorized account access, privacy breaches, and misuse of the platform.