CVE-2025-40897CWE-863broken-access-control

CVE-2025-40897

High · published April 15, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00325 · 24.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-04-15T13:16Z
References (2)
EPSS history
Timeline
  • 15 APR 08:18Z
    Incorrect authorization for Threat Intelligence in Guardian/CMC before 26.0.0
    cvelistv5