BaseFortify

Publication date: 2025-10-27

Last updated on: 2025-10-30

Assigner: MITRE

Description

IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not enforce proper authorization checks, allowing authenticated users to access or modify data belonging to other users by changing object identifiers in API requests. Attackers can exploit this flaw to view or modify sensitive records without proper authorization.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-27

Last Modified

2025-10-30

Generated

2026-07-06

AI Q&A

2025-10-27

EPSS Evaluated

2026-07-05

NVD

CVE-2025-60982

EUVD

EUVD-2025-36220

Affected Vendors & Products

Vendor	Product	Version / Range
educare	educare_erp	1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in Educare ERP 1.0. It occurs because certain API endpoints do not properly enforce authorization checks, allowing authenticated users to manipulate object identifiers in requests to access or modify data that belongs to other users without permission.

Impact Analysis

This vulnerability can allow attackers to view or modify sensitive records that they should not have access to, potentially leading to unauthorized disclosure or alteration of confidential information.

Hi! I’m here to help you understand CVE-2025-60982. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70