High · published December 3, 2025
⚡ A common SQL Server user account powers the database connection for NMIS/BioDose, but don’t let that fool you — it’s like leaving your car keys in the ignition while locked in your garage! 🔒 Imagine you run a restaurant where the kitchen can serve customers regardless of orders taken at the front. If anyone can access the kitchen with just a shared passcode, they could whip up whatever they want — a recipe for disaster! An attacker could exploit this vulnerability to access sensitive information directly from the database, bypassing client-side restrictions. This could lead to unauthorized data modifications or even deletions — absolutely devastating for your organization’s integrity!
Imagine you run a restaurant where the kitchen can serve customers regardless of orders taken at the front. If anyone can access the kitchen with just a shared passcode, they could whip up whatever they want — a recipe for disaster! CVE-2025-61940 arises because NMIS/BioDose uses a single SQL Server user account for database access, allowing all authenticated users to connect with elevated privileges. The latest version introduces Windows user authentication to tighten access controls, but earlier versions remain risky.
An attacker could exploit this vulnerability to access sensitive information directly from the database, bypassing client-side restrictions. This could lead to unauthorized data modifications or even deletions — absolutely devastating for your organization’s integrity! Upgrade to the latest version of NMIS/BioDose to enable Windows user authentication. Review user access logs to identify any suspicious activity, and consider implementing additional database encryption to further protect sensitive data. You've got this! Follow these steps, and you'll be one step closer to securing your database connections! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mirion/biodose\/nmis | < 23.0 | 23.0 |