CVE-2025-61118: mCarFix Motorists App · Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 7.5 High.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 24% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 30 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate this vulnerability, developers and organizations should immediately implement strong access control mechanisms that enforce strict verification during account registration, such as multi-factor authentication or CAPTCHA to prevent automated fake account creation. The use of sequential numeric IDs should be replaced with non-predictable, randomized identifiers to prevent tampering and unauthorized data access. Regular security audits and code reviews focusing on authentication and authorization logic are essential. Organizations should monitor application logs for unusual registration patterns or access attempts indicative of exploitation. If possible, restrict API endpoints to authenticated and authorized users only. Promptly apply any patches or updates released by the app developer. For organizations integrating with the mCarFix app, consider isolating its data and limiting permissions until the vulnerability is resolved. User education about suspicious activity and reporting mechanisms can also help detect abuse early. Finally, ensure compliance with GDPR by reviewing data protection measures and breach response plans.
Description
mCarFix Motorists App version 2.3 (package name com.skytop.mcarfix), developed by Paniel Mwaura, contains improper access control vulnerabilities. Attackers may bypass verification to arbitrarily register accounts, and by tampering with sequential numeric IDs, gain unauthorized access to user data and groups. Successful exploitation could result in fake account creation, privacy breaches, and misuse of the platform.