CVE-2025-67466CWE-862broken-access-control

CVE-2025-67466

Medium · published December 9, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

⚠️ A slip in access control could leave sensitive resources wide open! This missing authorization vulnerability in Trinity Audio could let unauthorized users waltz right in. 🔓 Think of it like a restaurant where the staff forgets to check reservations — anyone could just walk in and sit down at any table, even if they shouldn’t be there! If exploited, an unauthorized user could potentially access sensitive audio data or make changes within the system, putting privacy and data integrity at risk. While it’s not the end of the world, this could lead to unwelcome surprises. 🚨

Put simply

Think of it like a restaurant where the staff forgets to check reservations — anyone could just walk in and sit down at any table, even if they shouldn’t be there! This vulnerability arises from incorrectly configured access control levels in Trinity Audio versions n/a through 5.23.3, allowing users to bypass intended authorization mechanisms entirely.

What to do

If exploited, an unauthorized user could potentially access sensitive audio data or make changes within the system, putting privacy and data integrity at risk. While it’s not the end of the world, this could lead to unwelcome surprises. 🚨 To protect your application, quickly assess your access control settings and upgrade Trinity Audio to version 5.23.4 or later. Additionally, ensure all security levels are correctly configured to restrict unauthorized access. 🛡️ You've got this! Fixing this vulnerability will bolster your defenses and keep your resources safe. 💪😊

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00230 · 13.0th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-09T21:18Z
References (1)
EPSS history
Timeline
  • 09 DEC 14:13Z
    WordPress Trinity Audio plugin <= 5.23.3 - Broken Access Control vulnerability
    cvelistv5