CVE-2025-26376

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-26376
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to modify user data via crafted HTTP requests.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26376 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:q-free:maxtime:*:*:*:*:*:*:*:*
History

10 Apr 2025, 19:54

Type Values Removed Values Added
Summary
  • (es) Un CWE-862 "Autorización faltante" en maxprofile/users/routes.lua en Q-Free MaxTime menor o igual a la versión 2.11.0 permite que un atacante autenticado (con pocos privilegios) modifique datos del usuario a través de solicitudes HTTP manipulado.
CPE cpe:2.3:a:q-free:maxtime:*:*:*:*:*:*:*:*
References () https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26376 - () https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26376 - Third Party Advisory
First Time Q-free
Q-free maxtime

12 Feb 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-12 14:15

Updated : 2025-04-10 19:54

NVD link : CVE-2025-26376

Mitre link : CVE-2025-26376

CVE.ORG link : CVE-2025-26376

JSON object : View

Products Affected

q-free

  • maxtime
CWE
CWE-862

Missing Authorization