CVE-2025-11439
BaseFortify
Publication date: 2025-10-08
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jhumanj | opnform | to 1.9.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-11439 is an authorization bypass vulnerability in JhumanJ OpnForm versions up to 1.9.3. It affects the /show/integrations endpoint, where missing proper authorization checks allow an attacker to remotely access protected resources without the required privileges. Specifically, a low-privileged user can access integration details, such as webhook URLs, that should be restricted to higher privilege users. This flaw enables unauthorized data access due to improper access control. [1, 2]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers with low privileges to access sensitive integration information, such as webhook URLs, that should be restricted. This unauthorized access can lead to confidentiality breaches, as attackers can enumerate and potentially misuse integration endpoints. The exploit is publicly available and easy to execute, increasing the risk of exploitation if the patch is not applied. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the vulnerable endpoint `/show/integrations` on the affected JhumanJ OpnForm versions (up to 1.9.3) without proper authorization. A simple detection method is to send an HTTP request to the endpoint and observe if unauthorized access is granted. For example, you can use curl to test access: curl -i -X GET http://<target-host>/forms/<form-slug>/show/integrations If the response returns sensitive integration or webhook information without proper authentication or authorization, the system is vulnerable. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to apply the available patch identified by the commit hash `11d97d78f2de2cb49f79baed6bde8b611ec1f384` from the official GitHub repository of JhumanJ OpnForm. This patch fixes the missing authorization checks on the `/show/integrations` endpoint. Until the patch is applied, restrict access to the vulnerable endpoint by network controls or authentication mechanisms to prevent unauthorized access. [1, 2]