CVE-2025-13124CWE-639

CVE-2025-13124

High · published December 11, 2025

CVSS v3.1
7.6
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

⚡ An authorization bypass vulnerability in ApplyLogic lets users control key identifiers — think of it as giving someone the ability to change the lock on the front door without permission! 🔑 Imagine a restaurant where patrons can just tell the waiter to change their order — no questions asked! This means anyone could sneak in and change what they're allowed to access, potentially leading to a buffet of sensitive information. An attacker could exploit this vulnerability to gain unauthorized access to sensitive data or functions within the ApplyLogic system, essentially compromising the very trust built into the identifiers. This could lead to data breaches, unauthorized actions, and an overall erosion of system integrity. Yikes!

Put simply

Imagine a restaurant where patrons can just tell the waiter to change their order — no questions asked! This means anyone could sneak in and change what they're allowed to access, potentially leading to a buffet of sensitive information. This vulnerability arises because the system fails to properly validate user-controlled identifiers, allowing attackers to bypass authorization checks and access resources they shouldn’t be able to touch.

What to do

An attacker could exploit this vulnerability to gain unauthorized access to sensitive data or functions within the ApplyLogic system, essentially compromising the very trust built into the identifiers. This could lead to data breaches, unauthorized actions, and an overall erosion of system integrity. Yikes! To remediate this, ensure you update to the latest version of ApplyLogic where this vulnerability is patched. Additionally, implement stricter validation checks for user-controlled identifiers to prevent unauthorized access. Don't wait—act now! You've got this! With a little effort and prompt action, you can lock this door tight and keep the heroes of your system safe! 🛡️

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-11T20:15Z
References (2)
EPSS history
Timeline
  • 11 DEC 14:30Z
    IDOR in Netiket''s ApplyLogic
    cvelistv5