CVE-2025-59111CWE-863broken-access-control

CVE-2025-59111

Medium · published November 18, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
23.1
In the wild
Unconfirmed
What it is

Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI.

Only version 4.1 was tested and confirmed as vulnerable.

This issue was fixed in version 4.1 build 2250.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00314 · 23.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-11-18T20:16Z
Affected products (1)
ProductVersionsFixed in
windu/windu_cmsall versions—
References (2)
https://cert.pl/posts/2025/11/CVE-2025-59110 · [email protected]https://windu.org · [email protected]
EPSS history
Timeline
  • 18 NOV 13:26Z
    Broken Access Control in Windu CMS
    cvelistv5