CVE-2025-48589

CVE-2025-48589

High · published December 8, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
0.7
In the wild
Unconfirmed
What it is

⚡ A sneaky logic error in your code could let users gain permissions they shouldn’t have! Just like a friend letting themselves into your house while you’re not looking! 🔥 Think of it as a guest arriving at a party who suddenly decides they can access any room in your house without anyone stopping them – it’s a recipe for chaos! This vulnerability means unauthorized users could escalate their privileges without needing to break a sweat or even knock on the door. This could allow an attacker to waltz right in and access sensitive data or features meant for higher-privileged users. Imagine the havoc they could wreak: changing settings, accessing private information, or causing mayhem in your application without needing any permissions in advance - absolutely devastating!

Put simply

Think of it as a guest arriving at a party who suddenly decides they can access any room in your house without anyone stopping them – it’s a recipe for chaos! This vulnerability means unauthorized users could escalate their privileges without needing to break a sweat or even knock on the door. The vulnerability arises from a logic error in the HeaderPrivacyIconsController.kt file, allowing users to gain permissions across the user spectrum without proper authentication checks. This means that local escalation of privileges is possible with no need for additional execution rights from the attacker.

What to do

This could allow an attacker to waltz right in and access sensitive data or features meant for higher-privileged users. Imagine the havoc they could wreak: changing settings, accessing private information, or causing mayhem in your application without needing any permissions in advance - absolutely devastating! To mitigate this risk, review and update the affected code to ensure proper permission checks are in place before granting access. Make sure to test thoroughly to close any loopholes that allow for unintended privilege escalation. Consider patching to an updated version once it’s available. You’ve got this! By addressing this vulnerability, you’ll be one step closer to securing your application and earning your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00098 · 0.7th percentile
Published
2025-12-08T22:16Z
Affected products (4)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (2)
EPSS history
Timeline
  • 08 DEC 16:57Z
    In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code
    cvelistv5