CVE-2025-62688CWE-732

CVE-2025-62688

High · published October 24, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
3.9
In the wild
Unconfirmed
What it is

⚠️ A low-privileged user can magically upgrade their access! In Productivity Suite version 4.4.1.19, a single permission misconfiguration allows this sneaky role change. 🔍 Think of it like a restaurant where a waiter discovers a hidden door to the manager's office and walks in! They can now make changes to the menu and handle complaints without anyone batting an eye. This vulnerability could lead to unauthorized users gaining full control over critical projects, changing settings, and accessing sensitive information. Imagine the chaos if that well-meaning but mischievous waiter starts changing orders and policies without permission!

Put simply

Think of it like a restaurant where a waiter discovers a hidden door to the manager's office and walks in! They can now make changes to the menu and handle complaints without anyone batting an eye. This incorrect permission assignment allows attackers with low-level credentials to elevate their roles within the Product Suite, effectively granting them full access to resources they shouldn't control.

What to do

This vulnerability could lead to unauthorized users gaining full control over critical projects, changing settings, and accessing sensitive information. Imagine the chaos if that well-meaning but mischievous waiter starts changing orders and policies without permission! To protect against this vulnerability, ensure proper permission settings are enforced for all user roles. Update to the latest version of the software and conduct regular audits of user access rights to keep this attack vector at bay. 🛡️ You've got this! By following these steps, you can secure your projects in no time! 🚀

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00151 · 3.9th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2025-10-24T02:15Z
References (4)
EPSS history
Timeline
  • 23 OCT 21:58Z
    AutomationDirect Productivity Suite Incorrect Permission Assignment for Critical Resource
    cvelistv5