CVE-2025-66433CWE-863broken-access-control

CVE-2025-66433

Medium · published November 30, 2025

CVSS v3.1
4.2
EPSS
0%
Percentile
0.8
In the wild
Unconfirmed
What it is

HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job. This is fixed in 24.12.14, 25.0.3, and 25.3.1. The earliest affected version is 24.7.3.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00100 · 0.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-11-30T10:16Z
References (1)
https://htcondor.org/security/vulnerabilities/HTCONDOR-2025-0002.html · [email protected]
EPSS history
Timeline
  • 30 NOV 00:00Z
    HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by submitting a batch job
    cvelistv5