CVE-2025-52289
BaseFortify
Publication date: 2025-07-31
Last updated on: 2025-08-06
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| magnussolution | magnusbilling | 7.8.5.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Broken Access Control issue in MagnusBilling v7.8.5.3 where newly registered users can escalate their privileges by sending a specially crafted request to the /mbilling/index.php/user/save endpoint. This allows them to change their account status from "pending" to "active" without needing administrator approval.
How can this vulnerability impact me? :
The vulnerability allows unauthorized users to activate their accounts without administrator approval, potentially gaining access to features or data they should not have. This can lead to unauthorized access, privilege escalation, and compromise of the system's integrity.