CVE-2025-1031CWE-639

IDOR in Utarit Informatics' SoliClub

High · published December 18, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

⚡ An authorization bypass in SoliClub lets users wield powers they shouldn't have — think of it as giving the keys to the entire office to someone who only needs access to the break room! 🔑 Imagine a restaurant where the kitchen staff can access the safe holding the secret recipe just because they know the manager's name. This vulnerability allows unauthorized users to misuse functionality as if they had the right credentials, leading to potential chaos. An attacker could manipulate the system, enabling unauthorized actions or access to sensitive information — like letting someone serve dishes without ever having been trained! This could lead to data breaches or significant service disruptions, making it a serious issue for any organization using SoliClub.

Put simply

Imagine a restaurant where the kitchen staff can access the safe holding the secret recipe just because they know the manager's name. This vulnerability allows unauthorized users to misuse functionality as if they had the right credentials, leading to potential chaos. This vulnerability in Utarit Informatics Services Inc. SoliClub allows a user-controlled key to bypass proper authorization checks, meaning users can exploit the functionality without the necessary permissions.

What to do

An attacker could manipulate the system, enabling unauthorized actions or access to sensitive information — like letting someone serve dishes without ever having been trained! This could lead to data breaches or significant service disruptions, making it a serious issue for any organization using SoliClub. Upgrade to SoliClub version 5.3.7 or later immediately to close this vulnerability. Additionally, review user permissions and implement stricter access controls to ensure that only authorized personnel can access critical features. Regular audits can help prevent future issues. You've got this! Follow these steps, and you'll patch this vulnerability like a pro! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-18T14:27Z
EPSS history
Timeline
  • 18 DEC 14:27Z
    IDOR in Utarit Informatics' SoliClub
    cvelistv5