CVE-2025-61876

5.0 mediumEPSS 0.2%

Medium (5.0). EPSS 0.2% chance of exploitation in the next 30 days.

Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an authenticated user with low privileges to enumerate and access tenant information belonging to other clients via modification of the tenant ID in the request URL.

Severity

CVSS 3.1

5.0 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE: CWE-639
Published: 2025-10-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://silvatech.uk/cve-2025-61876-inforcer-platform/
https://www.inforcer.com/platform
https://silvatech.uk/cve-2025-61876-inforcer-platform/

Check your stack JSON