High · published December 25, 2025
⚡ A sneaky access control flaw in Pexip Infinity can let remote attackers access sensitive data without raising an alarm! 🔥 Think of it like a hotel that gives out room keys without checking who’s really asking — anyone with a key card can stroll right into any room and peek inside, possibly causing chaos! An attacker could exploit this vulnerability to read sensitive information stored on the Exchange service, and even trigger a denial of service, leaving users locked out. This could lead to serious disruptions, compromising your system's integrity and availability!
Think of it like a hotel that gives out room keys without checking who’s really asking — anyone with a key card can stroll right into any room and peek inside, possibly causing chaos! This flaw arises from improper access control in the Secure Scheduler for Exchange service, specifically when handling Office 365 Legacy Exchange Tokens, allowing unauthorized data access and resource exhaustion.
An attacker could exploit this vulnerability to read sensitive information stored on the Exchange service, and even trigger a denial of service, leaving users locked out. This could lead to serious disruptions, compromising your system's integrity and availability! To protect your system, immediately upgrade Pexip Infinity to version 38.1 or later, and review your access controls to ensure they're robust. Regular audits of your configurations can also keep you safe from similar vulnerabilities in the future! You've got this! By taking these steps, you'll be well on your way to securing your system. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| pexip/pexip_infinity | ≥ 15, < 38.1 | 38.1 |