CVE-2025-36228CWE-279

CVE-2025-36228

Low · published December 26, 2025

CVSS v3.1
3.8
EPSS
0%
Percentile
11.9
In the wild
Unconfirmed
What it is

IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00220 · 11.9th percentile
Weakness
CWE-279 · Incorrect Execution-Assigned Permissions
Published
2025-12-26T20:15Z
Affected products (1)
ProductVersionsFixed in
ibm/aspera_faspex≥ 5.0.0, < 5.0.14.25.0.14.2
References (1)
https://www.ibm.com/support/pages/node/7255331 · [email protected]
EPSS history
Timeline
  • 26 DEC 14:11Z
    Incorrect Execution-Assigned Permissions in IBM Aspera Faspex
    cvelistv5