CVE-2025-14101CWE-639

CVE-2025-14101

High · published December 17, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

⚡ An authorization bypass vulnerability in PaperWork lets crafty users manipulate identifiers to gain unauthorized access. 🚨 Think of it like a restaurant where customers can alter their reservation names—if no one verifies the guest list, anyone can walk in and claim the best table! An attacker could exploit this flaw to access sensitive information or perform actions they shouldn’t be able to, like watching the chef prepare special recipes. This unauthorized access poses a significant risk to user data and system integrity—definitely not a recipe for success!

Put simply

Think of it like a restaurant where customers can alter their reservation names—if no one verifies the guest list, anyone can walk in and claim the best table! This vulnerability occurs when user-controlled keys bypass authorization checks within PaperWork, allowing unauthorized users to exploit trusted identifiers. The mechanism fails to properly verify user permissions, leading to potential unauthorized actions.

What to do

An attacker could exploit this flaw to access sensitive information or perform actions they shouldn’t be able to, like watching the chef prepare special recipes. This unauthorized access poses a significant risk to user data and system integrity—definitely not a recipe for success! Upgrade PaperWork to version 6.0 or later immediately. Ensure all user inputs are validated against strict permissions and consider implementing additional logging to catch suspicious activities. Don't delay—this needs your attention! You’ve got this! Follow these steps, and you’ll be one step closer to securing your system! 🛡️

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-12-17T15:15Z
References (2)
EPSS history
Timeline
  • 17 DEC 09:11Z
    IDOR in GG Soft's PaperWork
    cvelistv5