{"cve":"CVE-2025-57817","nvd":{"published":"2025-09-08T22:15:33.880","modified":"2026-06-17T09:43:29.553","status":"Analyzed","description":"Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with `client:create` or `client:update` permissions to escalate their privileges to owner-level. Version 2.69.1 fixes the issue. No known workarounds are available.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":8.6},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-862"],"references":["https://github.com/ethyca/fides/commit/2ffd125e1089a09b84c27fb5279a05960cbf2452","https://github.com/ethyca/fides/releases/tag/2.69.1","https://github.com/ethyca/fides/security/advisories/GHSA-hjfh-p8f5-24wr"],"products":["ethyca:fides"],"source":"nvd","synced_at":"2026-10-19T22:08:41.295252406+00:00"},"epss":{"cve":"CVE-2025-57817","score":0.0042,"percentile":0.36385,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hjfh-p8f5-24wr","url":"https://osv.dev/vulnerability/GHSA-hjfh-p8f5-24wr","summary":"Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation","modified":"2026-09-10T03:50:58.267131618Z","packages":[{"ecosystem":"PyPI","name":"ethyca-fides","purl":"pkg:pypi/ethyca-fides","ranges":["<2.69.1"],"fixed":["2.69.1"]}]},{"id":"PYSEC-2026-1343","url":"https://osv.dev/vulnerability/PYSEC-2026-1343","summary":"Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation","modified":"2026-07-07T17:46:40.614368307Z","packages":[{"ecosystem":"PyPI","name":"ethyca-fides","purl":"pkg:pypi/ethyca-fides","ranges":["<2.69.1"],"fixed":["2.69.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}