CVE-2025-8148CWE-732CWE-863broken-access-control

CVE-2025-8148

Medium · published December 6, 2025

CVSS v3.1
4.2
EPSS
0%
Percentile
5.7
In the wild
Unconfirmed
What it is

An Improper Access Control in the SFTP service in Fortra's GoAnywhere MFT prior to version 7.9.0 allows Web Users with an Authentication Alias and a valid SSH key but limited to Password authentication for SFTP to still login using their SSH key.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00167 · 5.7th percentile
Weaknesses
CWE-732 · Incorrect Permission Assignment for Critical Resource; CWE-863 · Incorrect Authorization
Published
2025-12-06T02:15Z
Affected products (1)
ProductVersionsFixed in
fortra/goanywhere_managed_file_transfer< 7.9.07.9.0
References (1)
https://www.fortra.com/security/advisories/product-security/fi-2025-013 · df4dee71-de3a-4139-9588-11b62fe6c0ff
EPSS history
Timeline
  • 05 DEC 20:56Z
    CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT
    cvelistv5