Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki) can obtain programming right/perform remote code execution by editing the application. This vulnerability has been fixed in XWiki 17.0.0, 16.4.7, and 16.10.3.

CVE-2025-49586 is a high-severity vulnerability affecting the XWiki platform, an open-source wiki software widely used for collaborative documentation and knowledge management. The vulnerability is classified under CWE-863, which pertains to incorrect authorization. Specifically, any user with edit rights on at least one 'App Within Minutes' application—a default permission granted to all XWiki users—can escalate their privileges to obtain programming rights. This privilege escalation enables remote code execution (RCE) by modifying the application code. The flaw arises because the platform fails to properly enforce authorization checks when users attempt to edit these applications, allowing unauthorized elevation of privileges without requiring additional authentication or user interaction. The vulnerability affects multiple versions of XWiki, including all releases from version 7.2-milestone-2 up to but not including 16.4.7, versions from 16.5.0-rc-1 up to but not including 16.10.3, and versions from 17.0.0-rc-1 up to but not including 17.0.0. The issue has been addressed in XWiki versions 16.4.7, 16.10.3, and 17.0.0. The CVSS 4.0 base score is 8.7, indicating a high severity level, with an attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:L, meaning low privileges are sufficient), no user interaction (UI:N), and high impact on confidentiality, integrity, and availability (all rated high). No known exploits are currently reported in the wild, but the ease of exploitation and potential impact make this a critical issue for affected deployments.

Detailed information about CVE-2025-49586: CWE-863: Incorrect Authorization in xwiki xwiki-platform affecting xwiki xwiki-platform. Get real-time updates, techn

CVE-2025-49586: CWE-863: Incorrect Authorization in xwiki xwiki-platform - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49586: CWE-863: Incorrect Authorization in xwiki xwiki-platform

The WordPress Single Sign-On (SSO) plugin for WordPress is vulnerable to unauthorized access due to a misconfigured capability check on a function in all versions up to, and including, the *.5.3 versions of the plugin. This makes it possible for unauthenticated attackers to extract sensitive data including site content that has been restricted to certain users and/or roles.

CVE-2025-6003 is a medium-severity vulnerability affecting the WordPress Single Sign-On (SSO) plugin developed by cyberlord92, specifically the Single Site Standard edition. The vulnerability arises from an incorrect authorization check (CWE-863) in the plugin's code, where a capability check is misconfigured or missing in a critical function. This flaw allows unauthenticated attackers to bypass intended access controls and extract sensitive data that should be restricted to certain users or roles. The affected versions include all versions up to and including the *.5.3 releases, indicating a broad impact across all currently deployed versions prior to a patch. The vulnerability does not require any user interaction or privileges, and can be exploited remotely over the network (AV:N, AC:L, PR:N, UI:N). The impact is limited to confidentiality, as attackers can read restricted site content but cannot modify data or disrupt availability. No known exploits are currently reported in the wild, and no official patches have been linked yet. The vulnerability was published on June 12, 2025, and is tracked under CWE-863, which relates to improper authorization checks that allow unauthorized access to resources. Given the widespread use of WordPress and the popularity of SSO plugins for managing user authentication, this vulnerability poses a significant risk to websites relying on this plugin for access control, potentially exposing sensitive or proprietary content to unauthorized parties.

Detailed information about CVE-2025-6003: CWE-863 Incorrect Authorization in cyberlord92 WordPress Single Sign-On (SSO) - Single Site Standard affecting cyberlo

CVE-2025-6003: CWE-863 Incorrect Authorization in cyberlord92 WordPress Single Sign-On (SSO) - Single Site Standard - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-6003: CWE-863 Incorrect Authorization in cyberlord92 WordPress Single Sign-On (SSO) - Single Site Standard

Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.

CVE-2025-48446 is an Incorrect Authorization vulnerability classified under CWE-863, affecting the Drupal Commerce Alphabank Redirect module versions prior to 1.0.3, specifically version 0.0.0. This vulnerability arises from improper authorization checks within the module's redirect functionality, which is designed to facilitate payment redirection to Alphabank services in e-commerce transactions. Due to the flawed authorization logic, an attacker with limited privileges or potentially unauthenticated users could misuse the redirect functionality to perform unauthorized actions or redirect users to unintended or malicious destinations. This could lead to functionality misuse, such as bypassing intended access controls, manipulating transaction flows, or redirecting customers to phishing or fraudulent payment pages. The vulnerability does not currently have any known exploits in the wild, and no official patches or updates have been linked yet, although the fixed version is indicated as 1.0.3. The lack of a CVSS score suggests that the vulnerability has been recently disclosed and is pending further assessment. The vulnerability affects a niche but critical component used in Drupal-based e-commerce sites that integrate with Alphabank payment systems, which are primarily relevant in regions where Alphabank operates or where Drupal Commerce is widely adopted. The core issue is the failure to properly verify user permissions before allowing redirect operations, which could compromise transaction integrity and user trust in the affected e-commerce platforms.

Detailed information about CVE-2025-48446: CWE-863 Incorrect Authorization in Drupal Commerce Alphabank Redirect affecting Drupal Commerce Alphabank Redirect. G

CVE-2025-48446: CWE-863 Incorrect Authorization in Drupal Commerce Alphabank Redirect - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48446: CWE-863 Incorrect Authorization in Drupal Commerce Alphabank Redirect

Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affects Commerce Eurobank (Redirect): from 0.0.0 before 2.1.1.

CVE-2025-48445 is an Incorrect Authorization vulnerability (CWE-863) identified in the Drupal Commerce Eurobank (Redirect) module, affecting versions prior to 2.1.1. This vulnerability arises from improper enforcement of authorization checks within the module, allowing unauthorized users to misuse functionality that should be restricted. Specifically, the flaw permits attackers to perform actions or access resources that require higher privileges, potentially by exploiting redirect mechanisms within the Commerce Eurobank integration. Since the vulnerability is categorized under incorrect authorization, it implies that the system fails to adequately verify whether a user has the necessary permissions before allowing certain operations, leading to functionality misuse. The affected product is a Drupal module used in e-commerce environments, particularly those integrating Eurobank payment or redirect services. No CVSS score has been assigned yet, and no known exploits are reported in the wild as of the publication date (June 11, 2025). The vulnerability affects all versions from 0.0.0 up to but not including 2.1.1, indicating that patches or updates beyond 2.1.1 likely address this issue. The lack of a patch link suggests that either the fix is bundled in a newer release or is pending formal publication. Given the nature of Drupal modules and their deployment in web applications, exploitation could allow attackers to bypass intended access controls, potentially redirect users to malicious sites, manipulate transaction flows, or interfere with payment processing steps, thereby undermining the integrity and trustworthiness of e-commerce transactions.

Detailed information about CVE-2025-48445: CWE-863 Incorrect Authorization in Drupal Commerce Eurobank (Redirect) affecting Drupal Commerce Eurobank (Redirect).

CVE-2025-48445: CWE-863 Incorrect Authorization in Drupal Commerce Eurobank (Redirect) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48445: CWE-863 Incorrect Authorization in Drupal Commerce Eurobank (Redirect)

During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly known as Secure Boot) in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the vulnerability at this time. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.

CVE-2023-5553 is a high-severity vulnerability identified in AXIS OS, the operating system used by Axis Communications AB in their network video products. The flaw pertains to an incorrect authorization issue (CWE-863) affecting the Secure Boot mechanism, which is designed to protect devices from tampering by ensuring only trusted firmware and software components are loaded during startup. The vulnerability was discovered during Axis' internal Security Development Model threat modeling, indicating a sophisticated bypass of Secure Boot protections is possible. This bypass could allow an attacker with network-level access (as indicated by the CVSS vector AV:P - physical access, but the vector here is AV:P which usually means physical, but the CVSS vector given is AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) to execute unauthorized code or modify the device firmware without proper authorization. The vulnerability affects AXIS OS versions 10.8 through 11.6. Although no known exploits have been reported in the wild, the potential impact is significant due to the critical role Secure Boot plays in device integrity. The vulnerability's CVSS score of 7.6 reflects high impact on confidentiality, integrity, and availability, with no privileges or user interaction required for exploitation. Axis has released patched versions of AXIS OS to address this issue, emphasizing the importance of timely updates to mitigate risk.

Detailed information about CVE-2023-5553: CWE-863: Incorrect Authorization in Axis Communications AB AXIS OS affecting Axis Communications AB AXIS OS. Get real-

CVE-2023-5553: CWE-863: Incorrect Authorization in Axis Communications AB AXIS OS - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2023-5553: CWE-863: Incorrect Authorization in Axis Communications AB AXIS OS

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All versions < V3.2), SCALANCE XC324-4 (6GK5328-4TS00-2AC2) (All versions < V3.2), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) (All versions < V3.2), SCALANCE XC332 (6GK5332-0GA00-2AC2) (All versions < V3.2), SCALANCE XC416-8 (6GK5424-8TR00-2AC2) (All versions < V3.2), SCALANCE XC424-4 (6GK5428-4TR00-2AC2) (All versions < V3.2), SCALANCE XC432 (6GK5432-0GR00-2AC2) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.2), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.2), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-2AR3) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-3AR3) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-4AR3) (All versions < V3.2), SCALANCE XR322-12 (6GK5334-3TS00-2AR3) (All versions < V3.2), SCALANCE XR322-12 (6GK5334-3TS00-3AR3) (All versions < V3.2), SCALANCE XR322-12 (6GK5334-3TS00-4AR3) (All versions < V3.2), SCALANCE XR326-8 (6GK5334-2TS00-2AR3) (All versions < V3.2), SCALANCE XR326-8 (6GK5334-2TS00-3AR3) (All versions < V3.2), SCALANCE XR326-8 (6GK5334-2TS00-4AR3) (All versions < V3.2), SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-2AR3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-3AR3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-4AR3) (All versions < V3.2), SCALANCE XR522-12 (6GK5534-3TR00-2AR3) (All versions < V3.2), SCALANCE XR522-12 (6GK5534-3TR00-3AR3) (All versions < V3.2), SCALANCE XR522-12 (6GK5534-3TR00-4AR3) (All versions < V3.2), SCALANCE XR526-8 (6GK5534-2TR00-2AR3) (All versions < V3.2), SCALANCE XR526-8 (6GK5534-2TR00-3AR3) (All versions < V3.2), SCALANCE XR526-8 (6GK5534-2TR00-4AR3) (All versions < V3.2), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.2). An internal session termination functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with "guest" role to terminate legitimate users' sessions.

CVE-2025-40568 is a medium-severity vulnerability affecting multiple Siemens industrial networking devices, specifically the RUGGEDCOM RST2428P and a broad range of SCALANCE series switches (including XC, XR, XCH, XCM, XRM, and XRH models) with firmware versions prior to V3.2. The root cause is an incorrect authorization check (CWE-863) in the internal session termination functionality of the web interface. This flaw allows an authenticated remote attacker with only "guest" level privileges to forcibly terminate active sessions of legitimate users. The vulnerability does not allow direct compromise of confidentiality or integrity but impacts availability by disrupting legitimate user sessions, potentially causing denial of service conditions for network administrators or automated management systems. The CVSS v3.1 base score is 4.3 (medium), reflecting network attack vector (AV:N), low attack complexity (AC:L), requiring low privileges (PR:L) but no user interaction (UI:N), with impact limited to availability (A:L) only. The scope remains unchanged (S:U), meaning the vulnerability affects only the vulnerable component. Exploitation requires authentication at the guest level, which is often accessible in operational environments for limited monitoring or configuration. No public exploits are currently known. These devices are widely used in industrial control systems (ICS) and critical infrastructure networks for secure, ruggedized Ethernet switching and routing, often deployed in energy, transportation, manufacturing, and utilities sectors. The vulnerability could be leveraged by an insider or a remote attacker who has gained guest access to disrupt network management operations, potentially delaying incident response or maintenance activities. Siemens has not yet published patches, so mitigation relies on compensating controls and monitoring.

Detailed information about CVE-2025-40568: CWE-863: Incorrect Authorization in Siemens RUGGEDCOM RST2428P affecting Siemens RUGGEDCOM RST2428P. Get real-time up

CVE-2025-40568: CWE-863: Incorrect Authorization in Siemens RUGGEDCOM RST2428P - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-40568: CWE-863: Incorrect Authorization in Siemens RUGGEDCOM RST2428P

A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XC316-8 (6GK5324-8TS00-2AC2) (All versions < V3.2), SCALANCE XC324-4 (6GK5328-4TS00-2AC2) (All versions < V3.2), SCALANCE XC324-4 EEC (6GK5328-4TS00-2EC2) (All versions < V3.2), SCALANCE XC332 (6GK5332-0GA00-2AC2) (All versions < V3.2), SCALANCE XC416-8 (6GK5424-8TR00-2AC2) (All versions < V3.2), SCALANCE XC424-4 (6GK5428-4TR00-2AC2) (All versions < V3.2), SCALANCE XC432 (6GK5432-0GR00-2AC2) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SCALANCE XCM324 (6GK5324-8TS01-2AC2) (All versions < V3.2), SCALANCE XCM328 (6GK5328-4TS01-2AC2) (All versions < V3.2), SCALANCE XCM332 (6GK5332-0GA01-2AC2) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-2AR3) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-3AR3) (All versions < V3.2), SCALANCE XR302-32 (6GK5334-5TS00-4AR3) (All versions < V3.2), SCALANCE XR322-12 (6GK5334-3TS00-2AR3) (All versions < V3.2), SCALANCE XR322-12 (6GK5334-3TS00-3AR3) (All versions < V3.2), SCALANCE XR322-12 (6GK5334-3TS00-4AR3) (All versions < V3.2), SCALANCE XR326-8 (6GK5334-2TS00-2AR3) (All versions < V3.2), SCALANCE XR326-8 (6GK5334-2TS00-3AR3) (All versions < V3.2), SCALANCE XR326-8 (6GK5334-2TS00-4AR3) (All versions < V3.2), SCALANCE XR326-8 EEC (6GK5334-2TS00-2ER3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-2AR3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-3AR3) (All versions < V3.2), SCALANCE XR502-32 (6GK5534-5TR00-4AR3) (All versions < V3.2), SCALANCE XR522-12 (6GK5534-3TR00-2AR3) (All versions < V3.2), SCALANCE XR522-12 (6GK5534-3TR00-3AR3) (All versions < V3.2), SCALANCE XR522-12 (6GK5534-3TR00-4AR3) (All versions < V3.2), SCALANCE XR526-8 (6GK5534-2TR00-2AR3) (All versions < V3.2), SCALANCE XR526-8 (6GK5534-2TR00-3AR3) (All versions < V3.2), SCALANCE XR526-8 (6GK5534-2TR00-4AR3) (All versions < V3.2), SCALANCE XRH334 (24 V DC, 8xFO, CC) (6GK5334-2TS01-2ER3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 12xFO) (6GK5334-3TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230 V AC, 8xFO) (6GK5334-2TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-3AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 12xFO) (6GK5334-3TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24 V DC, 8xFO) (6GK5334-2TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-2AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 12xFO) (6GK5334-3TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230 V AC, 8xFO) (6GK5334-2TS01-4AR3) (All versions < V3.2), SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) (6GK5334-5TS01-4AR3) (All versions < V3.2). The "Load Rollback" functionality in the web interface of affected products contains an incorrect authorization check vulnerability. This could allow an authenticated remote attacker with "guest" role to make the affected product roll back configuration changes made by privileged users.

CVE-2025-40567 is a security vulnerability classified under CWE-863 (Incorrect Authorization) affecting multiple Siemens industrial networking devices, specifically the RUGGEDCOM RST2428P and a broad range of SCALANCE series switches (models XC316-8, XC324-4, XC332, XC416-8, XC424-4, XC432, XCH328, XCM324, XCM328, XCM332, XR302-32, XR322-12, XR326-8, XR502-32, XR522-12, XR526-8, XRH334, and XRM334) with firmware versions prior to V3.2. The vulnerability resides in the "Load Rollback" functionality accessible via the web interface of these devices. This functionality is intended to allow rollback of configuration changes to a previous state. However, due to an incorrect authorization check, an authenticated attacker with only "guest" level privileges can exploit this flaw to trigger rollback of configuration changes made by privileged users. This means that an attacker with minimal access rights can undo critical configuration updates, potentially disrupting network operations or reverting security hardening measures. The vulnerability does not allow direct compromise of confidentiality or availability but impacts the integrity of device configurations. The CVSS v3.1 base score is 6.5 (medium severity), with an attack vector of network (remote), low attack complexity, requiring privileges (guest role), no user interaction, and impacting integrity only. No known exploits are reported in the wild yet, and Siemens has not published patches at the time of this report. The affected devices are widely used in industrial control systems (ICS) and critical infrastructure networks, where configuration integrity is paramount for operational stability and security.

Detailed information about CVE-2025-40567: CWE-863: Incorrect Authorization in Siemens RUGGEDCOM RST2428P affecting Siemens RUGGEDCOM RST2428P. Get real-time up

CVE-2025-40567: CWE-863: Incorrect Authorization in Siemens RUGGEDCOM RST2428P - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-40567: CWE-863: Incorrect Authorization in Siemens RUGGEDCOM RST2428P

Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

CVE-2025-36578 is an Incorrect Authorization vulnerability (CWE-863) identified in Dell Wyse Management Suite versions prior to 5.2. This vulnerability allows a low-privileged attacker with remote network access to potentially bypass authorization controls and gain unauthorized access to management functions or sensitive data within the Wyse Management Suite environment. The flaw stems from improper enforcement of authorization checks, which means that certain operations or data that should be restricted to higher privileged users can be accessed or manipulated by users with limited privileges. The CVSS v3.1 base score is 6.8 (medium severity), reflecting high impact on confidentiality and integrity but no impact on availability. The attack vector is network-based (AV:N), requiring low privileges (PR:L), no user interaction (UI:N), and a high attack complexity (AC:H), indicating that exploitation is possible but requires some conditions or knowledge. The vulnerability does not require user interaction and affects the confidentiality and integrity of the system, potentially allowing unauthorized disclosure or modification of sensitive management data or configurations. No known exploits are currently reported in the wild, and no patches or mitigations have been explicitly linked yet. Dell Wyse Management Suite is a centralized management platform for thin clients and endpoints, widely used in enterprise and public sector environments for device provisioning, monitoring, and configuration management.

Detailed information about CVE-2025-36578: CWE-863: Incorrect Authorization in Dell Wyse Management Suite affecting Dell Wyse Management Suite. Get real-time up

CVE-2025-36578: CWE-863: Incorrect Authorization in Dell Wyse Management Suite - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-36578: CWE-863: Incorrect Authorization in Dell Wyse Management Suite

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to create a user and assign it many privileges by sending a POST request to /PC/frmGestionUser.aspx/updateUser.

CVE-2025-40670 is an incorrect authorization vulnerability identified in TCMAN's GIM product, specifically version 11. The vulnerability stems from improper access control mechanisms in the web interface endpoint /PC/frmGestionUser.aspx/updateUser. An unprivileged attacker can exploit this flaw by sending a crafted POST request to this endpoint, enabling them to create new user accounts and assign extensive privileges without proper authorization checks. This effectively bypasses intended security controls, allowing privilege escalation from a low-privilege or unauthenticated state to administrative-level access within the GIM system. The vulnerability is classified under CWE-863, which relates to incorrect authorization, indicating that the system fails to enforce correct permission checks before allowing sensitive operations. The CVSS 4.0 base score is 7.1 (high severity), with the vector indicating network attack vector (AV:N), low attack complexity (AC:L), no authentication required (AT:N), no user interaction (UI:N), and no impact on confidentiality or availability but high impact on integrity (VI:H). This suggests the attacker can manipulate system integrity by unauthorized user creation and privilege assignment, potentially leading to further compromise of the system or connected infrastructure. No known exploits are currently reported in the wild, and no patches have been published at the time of analysis. The vulnerability was reserved in April 2025 and published in June 2025, with INCIBE (Spain's National Cybersecurity Institute) as the assigner, indicating European awareness and involvement in tracking this issue.

Detailed information about CVE-2025-40670: CWE-863 Incorrect Authorization in TCMAN GIM affecting TCMAN GIM. Get real-time updates, technical details, and mitig

CVE-2025-40670: CWE-863 Incorrect Authorization in TCMAN GIM - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-40670: CWE-863 Incorrect Authorization in TCMAN GIM

Incorrect authorization vulnerability in TCMAN's GIM v11. This vulnerability allows an unprivileged attacker to modify the permissions held by each of the application's users, including the user himself by sending a POST request to /PC/Options.aspx?Command=2&amp;Page=-1.

CVE-2025-40669 is an incorrect authorization vulnerability identified in version 11 of TCMAN's GIM application. The vulnerability stems from improper access control mechanisms within the application, specifically allowing an unprivileged attacker to modify user permissions by sending a crafted POST request to the endpoint /PC/Options.aspx with parameters Command=2 and Page=-1. This flaw enables attackers without administrative privileges to escalate their own permissions or alter the permissions of other users within the system. The vulnerability is classified under CWE-863 (Incorrect Authorization), indicating that the application fails to properly enforce authorization policies before executing sensitive operations. The CVSS 4.0 base score of 7.1 (high severity) reflects the vulnerability's network attack vector (AV:N), low attack complexity (AC:L), no authentication required (AT:N), no user interaction (UI:N), and a high impact on integrity (VI:H) with no impact on confidentiality or availability. The scope remains unchanged, and no privileges or user interaction are required, making exploitation feasible remotely by an attacker with low privileges. Although no known exploits are currently reported in the wild, the vulnerability presents a significant risk due to the potential for unauthorized privilege escalation and manipulation of user permissions, which could lead to further compromise of the application and associated systems. The absence of available patches at the time of publication underscores the urgency for organizations to implement compensating controls and monitor for suspicious activity related to this endpoint.

Detailed information about CVE-2025-40669: CWE-863 Incorrect Authorization in TCMAN GIM affecting TCMAN GIM. Get real-time updates, technical details, and mitig

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-863'

Filter Threats

Threats Tagged 'cwe-863'