CVE-2025-12059CWE-538

Improper Access Control in Logo Software's Logo j-Platform

Critical · published February 11, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
28.6
In the wild
Unconfirmed
What it is

🚨 A single misconfiguration could expose sensitive files to the world! With Logo j-Platform, outdated settings mean unauthorized users can peek into sensitive directories. 🔥 Think of it as leaving the office door wide open while you step out for lunch—anyone can stroll in and access confidential documents on your desk! This vulnerability can lead to devastating consequences where attackers can access sensitive information, potentially resulting in data breaches or compliance issues. If exploited, it could compromise your entire application, putting your users at risk and damaging your organization's reputation.

Put simply

Think of it as leaving the office door wide open while you step out for lunch—anyone can stroll in and access confidential documents on your desk! The vulnerability arises from incorrectly configured access control security levels in Logo j-Platform, allowing external access to sensitive files or directories that should remain protected.

What to do

This vulnerability can lead to devastating consequences where attackers can access sensitive information, potentially resulting in data breaches or compliance issues. If exploited, it could compromise your entire application, putting your users at risk and damaging your organization's reputation. To remediate, upgrade to version 3.34.8.9 or later immediately. Audit your access control settings to ensure that sensitive information is adequately protected. Regularly review your security levels to prevent future misconfigurations. You've got this! By following these steps, you'll lock down your application like a pro! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00360 · 28.6th percentile
Weakness
CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory
Published
2026-02-11T13:58Z
EPSS history
Timeline
  • 11 FEB 13:58Z
    Improper Access Control in Logo Software's Logo j-Platform
    cvelistv5