CVE-2025-40670
BaseFortify
Publication date: 2025-06-09
Last updated on: 2025-10-06
Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tcman | gim | 11.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an incorrect authorization issue in TCMAN's GIM v11. It allows an unprivileged attacker to create a user account and assign many privileges to that user by sending a specially crafted POST request to the /PC/frmGestionUser.aspx/updateUser endpoint.
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can escalate privileges by creating a user with extensive permissions, potentially gaining unauthorized access to sensitive functions or data within the system, leading to security breaches and loss of control over the affected application.