{"cve":"CVE-2025-67796","nvd":{"published":"2026-05-04T20:16:16.260","modified":"2026-06-17T09:58:06.957","status":"Awaiting Analysis","description":"IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","score":8.1},"cwes":["CWE-284"],"references":["https://gitlab.com/ikus-soft/rdiffweb","https://gitlab.com/ikus-soft/rdiffweb#2106-2025-10-02"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:33:09.003606135+00:00"},"epss":{"cve":"CVE-2025-67796","score":0.00245,"percentile":0.15749,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-v4gp-hf5j-4566","url":"https://osv.dev/vulnerability/GHSA-v4gp-hf5j-4566","summary":"IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users","modified":"2026-07-13T16:42:50.174782371Z","packages":[{"ecosystem":"PyPI","name":"rdiffweb","purl":"pkg:pypi/rdiffweb","ranges":["<2.10.6"],"fixed":["2.10.6"]}]},{"id":"PYSEC-2026-3048","url":"https://osv.dev/vulnerability/PYSEC-2026-3048","summary":"IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users","modified":"2026-07-13T16:32:44.011298188Z","packages":[{"ecosystem":"PyPI","name":"rdiffweb","purl":"pkg:pypi/rdiffweb","ranges":["<2.10.6"],"fixed":["2.10.6"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}