CVE-2025-69727: INDEX-EDUCATION PRONOTE · Improper Access Control
Source CVE Database V5
Not known to be exploited · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 16:39 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Affects
- INDEX-EDUCATION PRONOTE prior to 2025.2.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 16 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2025-69727, organizations should apply the official patch from INDEX-EDUCATION as soon as it becomes available in version 2025.2.8 or later. Until patching is possible, implement network-level access controls to restrict access to profile image URLs, such as IP whitelisting or VPN requirements. Introduce rate limiting on requests to image endpoints to prevent automated enumeration. Review and enhance authorization logic to ensure that profile images are only accessible to authenticated and authorized users. Conduct audits of URL generation mechanisms to avoid predictable identifiers and consider using randomized or tokenized URLs for sensitive resources. Monitor web server logs for unusual access patterns indicative of scraping or brute force attempts. Educate staff and users about the risks of sharing predictable identifiers publicly. Finally, ensure compliance with data protection laws by documenting the vulnerability and response measures.
Description
An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components (index.js and composeUrlImgPhotoIndividu) allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to missing authorization checks and lack of rate-limiting when generating or accessing these URLs, an unauthenticated or unauthorized actor may retrieve profile pictures of users by crafting requests with guessed or known identifiers.