CVE-2025-53813
BaseFortify
Publication date: 2025-08-26
Last updated on: 2025-08-26
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| invoiceninja | invoiceninja | <5.0.175 |
| nozbe | nozbe | 2025.11 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves the configuration of Nozbe on macOS when the "RunAsNode" fuse is enabled. It allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe's Transparency, Consent, and Control (TCC) permissions. However, the attacker can only access resources that the user has previously granted permission to, and accessing other resources requires user interaction with a system prompt.
How can this vulnerability impact me? :
The vulnerability can allow a local attacker to run arbitrary code with the same TCC permissions as Nozbe, potentially accessing sensitive resources that the user has already granted permission to. This could lead to unauthorized actions or data exposure within the scope of those permissions.
What immediate steps should I take to mitigate this vulnerability?
Update Nozbe to version 2025.11 or later, as this issue was fixed in that version.