CVE-2025-13432CWE-863broken-access-control

CVE-2025-13432

Medium · published November 21, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00194 · 8.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-11-21T20:15Z
Affected products (2)
ProductVersionsFixed in
hashicorp/terraform≥ 1.0.0, < 1.0.31.0.3
hashicorp/terraformall versions—
References (1)
https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821 · [email protected]
EPSS history
Timeline
  • 21 NOV 14:20Z
    Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access
    cvelistv5