CVE-2025-61119

{
  "id": "CVE-2025-61119",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-30T17:15:39.123",
  "lastModified": "2026-11-05T14:10:00.273",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful exploitation could result in privacy breaches, unauthorized group access, and misuse of the platform."
    },
    {
      "lang": "es",
      "value": "La aplicación Kanova para Android versión 1.0.27 (nombre del paquete com.karelane), desarrollada por Karely L.L.C., contiene vulnerabilidades de control de acceso inadecuado. Los atacantes pueden obtener acceso no autorizado a los detalles del usuario y obtener información del grupo, incluidos los códigos de entrada, manipulando los parámetros de las solicitudes de la API. La explotación exitosa podría resultar en filtraciones de privacidad, acceso no autorizado a grupos y uso indebido de la plataforma."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-30T20:48:27.843278Z",
          "id": "CVE-2025-61119",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://kar1oz.notion.site/Kanova-2629a473ecb2801bac89ce99d0b30df7",
      "source": "[email protected]"
    }
  ]
}