CVE-2025-48042CWE-863broken-access-control

CVE-2025-48042

published September 7, 2025

CVSS

7.1

EPSS

0%

Percentile

24.2

In the wild

Unconfirmed

What it is

Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects ash: from 0.1.1 before 3.5.39.

The record

Technical detail

CVSS: 7.1 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00324 · 24.2th percentile
Weakness: CWE-863 · Incorrect Authorization
Published: 2025-09-07T20:15Z

References (5)

https://cna.erlef.org/cves/CVE-2025-48042.html · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db https://github.com/ash-project/ash/commit/4c41344126b0aba09ec3085517000f8aefec299e · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db https://github.com/ash-project/ash/commit/5d1b6a5d00771fd468a509778637527b5218be9a · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db https://github.com/ash-project/ash/security/advisories/GHSA-jj4j-x5ww-cwh9 · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db https://osv.dev/vulnerability/EEF-CVE-2025-48042 · 6b3ad84c-e1a6-4bf7-a703-f496b71e49db

EPSS history

Timeline

07 SEP 16:01Z
Before action hooks may execute in certain scenarios despite a request being forbidden
cvelistv5