This vulnerability (CVE-2026-25112) in Genetec RabbitMQ arises from CWE-732, where permissions for a security-critical resource are set incorrectly, enabling unauthorized read or modification access. The affected versions are all prior to 3.13.7.19. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that an attacker with local access and low complexity can escalate privileges without user interaction, impacting confidentiality, integrity, and availability. The vendor has not published a remediation level or patch information, and the product is not a cloud service, so remediation depends on vendor updates or configuration changes.

Successful exploitation allows an attacker with local access and low privileges to escalate their privileges by reading or modifying security-critical resources improperly protected by the product. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. There are no known active exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or guidance is provided by Genetec, users should review and tighten permissions on security-critical resources within their RabbitMQ deployments to limit access to authorized actors only. Monitor vendor channels for updates or patches addressing this vulnerability.