CVE-2025-67796

{
  "id": "CVE-2025-67796",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-04T20:16:16.260",
  "lastModified": "2026-11-04T20:10:00.263",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6."
    },
    {
      "lang": "es",
      "value": "IKUS Rdiffweb anterior a 2.10.5 tiene una falla de autorización impropia que permite a un atacante con cualquier token de acceso válido o robado actuar como otros usuarios. La API no impone la vinculación entre el sujeto autenticado y el usuario/inquilino objetivo, por lo que las solicitudes manipuladas pueden leer o modificar datos de otros usuarios y, en algunos casos, realizar acciones privilegiadas. Este problema puede habilitar el acceso entre inquilinos. Corregido en la versión 2.10.6."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-05T15:06:50.501564Z",
          "id": "CVE-2025-67796",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gitlab.com/ikus-soft/rdiffweb",
      "source": "[email protected]"
    },
    {
      "url": "https://gitlab.com/ikus-soft/rdiffweb#2106-2025-10-02",
      "source": "[email protected]"
    }
  ]
}