CVE-2025-65900

6.5 mediumEPSS 0.3%

Medium (6.5) in difuse kalmia. EPSS 0.3% chance of exploitation in the next 30 days.

Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all platform users.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2025-12-04
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

difuse:kalmia

References

https://github.com/DifuseHQ/Kalmia
https://github.com/Noxurge/CVE-2025-65900/blob/main/README.md

Check your stack JSON