CVE-2025-61876

{
  "id": "CVE-2025-61876",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-29T19:15:38.330",
  "lastModified": "2026-11-05T21:10:00.183",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an authenticated user with low privileges to enumerate and access tenant information belonging to other clients via modification of the tenant ID in the request URL."
    },
    {
      "lang": "es",
      "value": "Referencia Directa Insegura a Objeto (IDOR) en el punto de conexión de la API /tenants/{id} en la Plataforma Inforcer versión 2.0.153 permite a un usuario autenticado con privilegios bajos enumerar y acceder a información de inquilinos perteneciente a otros clientes mediante la modificación del ID del inquilino en la URL de la solicitud."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "baseScore": 5.0,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-30T14:32:39.911232Z",
          "id": "CVE-2025-61876",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://silvatech.uk/cve-2025-61876-inforcer-platform/",
      "source": "[email protected]"
    },
    {
      "url": "https://www.inforcer.com/platform",
      "source": "[email protected]"
    },
    {
      "url": "https://silvatech.uk/cve-2025-61876-inforcer-platform/",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}