CVE-2025-11554CWE-266CWE-277

CVE-2025-11554

Medium · published October 10, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the file app/Http/Controllers/AccessLevelController.php of the component User Type Handler. The manipulation leads to insecure inherited permissions. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.12 can resolve this issue. The identifier of the patch is d53365e5656f6499a4deddf89d522814655f769d. It is advisable to upgrade the affected component.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00375 · 30.3th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-277 · Insecure Inherited Permissions
Published
2025-10-10T00:15Z
Affected products (1)
ProductVersionsFixed in
portabilis/i-educar≥ 2.1.13, ≤ 2.9.10—
References (8)
https://github.com/m3m0o/portabilis-ieducar-user-type-privilege-escalation · [email protected]https://github.com/portabilis/i-educar/ · [email protected]https://github.com/portabilis/i-educar/commit/d53365e5656f6499a4deddf89d522814655f769d · [email protected]https://github.com/portabilis/i-educar/tree/2.12 · [email protected]https://vuldb.com/cve/CVE-2025-11554 · [email protected]https://vuldb.com/submit/671072 · [email protected]https://vuldb.com/vuln/327714 · [email protected]https://vuldb.com/vuln/327714/cti · [email protected]
EPSS history
Timeline
  • 09 OCT 20:02Z
    Portabilis i-Educar User Type AccessLevelController.php insecure inherited permissions
    cvelistv5