CVE-2025-46608CWE-284broken-access-control

CVE-2025-46608

Critical · published November 13, 2025

CVSS v3.1
9.1
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

🚨 A high-privileged attacker could exploit a simple oversight to gain control over your Dell Data Lakehouse! 🔥 Think of it like a VIP access pass that was given to someone who should only be a guest — they can waltz right into the back office, seeing and doing things they shouldn’t! This could lead to an attacker accessing sensitive customer data, changing system settings, or even locking you out entirely! The risks of data breaches and compromised integrity are absolutely devastating, putting your entire operation at serious risk.

Put simply

Think of it like a VIP access pass that was given to someone who should only be a guest — they can waltz right into the back office, seeing and doing things they shouldn’t! This vulnerability involves improper access control, allowing someone with remote access at high privilege levels to elevate their access and control the system beyond intended limits.

What to do

This could lead to an attacker accessing sensitive customer data, changing system settings, or even locking you out entirely! The risks of data breaches and compromised integrity are absolutely devastating, putting your entire operation at serious risk. Upgrade your Dell Data Lakehouse to version 1.6.0.0 or later immediately to close this critical gap. Additionally, review user permissions regularly to ensure that only the right people have high-level access. You've got this! Follow these steps, and you'll bolster your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00453 · 38.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2025-11-13T02:15Z
Affected products (1)
ProductVersionsFixed in
dell/data_lakehouse< 1.6.0.01.6.0.0
References (1)
EPSS history
Timeline
  • 12 NOV 20:12Z
    Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability
    cvelistv5