CVSS 4.0
8.6 highCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:NCVE-2025-57817
High (8.6) in ethyca fides. EPSS 0.4% chance of exploitation in the next 30 days. Fixed in ethyca-fides 2.69.1.
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with `client:create` or `client:update` permissions to escalate their privileges to owner-level. Version 2.69.1 fixes the issue. No known workarounds are available.
Severity
CVSS 3.1
7.2 highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
Affected
- ethyca:fides
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hjfh-p8f5-24wr | PyPI | ethyca-fides | <2.69.1 | 2.69.1 |
| PYSEC-2026-1343 | PyPI | ethyca-fides | <2.69.1 | 2.69.1 |