CVE-2025-2306

5.9 mediumEPSS 0.5%

Medium (5.9). EPSS 0.5% chance of exploitation in the next 30 days.

An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents without authentication, if the URL is known. The attack requires the attacker to know the documents UUIDv4.

Severity

CVSS 3.1

5.9 medium

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2025-05-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://www.cirosec.de/sa/sa-2025-004

Check your stack JSON