CVE-2025-21611CWE-285

tgstation-server's role authorization incorrectly OR'd with user's enabled status

High · published January 6, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions regardless of their permissions. Notably, the WriteUsers right is unaffected so users may not use this bug to permanently elevate their account permissions. The fix is release in tgstation-server-v6.12.3.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00484 · 40.8th percentile
Weakness
CWE-285 · Improper Authorization
Published
2025-01-06T15:38Z
EPSS history
Timeline
  • 06 JAN 15:38Z
    tgstation-server's role authorization incorrectly OR'd with user's enabled status
    cvelistv5