BaseFortify

Publication date: 2025-11-10

Last updated on: 2026-02-24

Assigner: VulDB

Description

A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authorization. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-10

Last Modified

2026-02-24

Generated

2026-07-07

AI Q&A

2025-11-10

EPSS Evaluated

2026-07-06

NVD

CVE-2025-12925

Affected Vendors & Products

Vendor	Product	Version / Range
rymcu	forest	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a security flaw in the rymcu forest software affecting certain functions (getAll, addDic, getAllDic, deleteDic) in the UserDicController.java file. The flaw allows missing authorization checks, meaning an attacker can remotely exploit these functions without proper permission.

Impact Analysis

The vulnerability can allow an attacker to remotely access and manipulate user dictionary functions without authorization, potentially leading to unauthorized data access, modification, or deletion. This can compromise the integrity and confidentiality of the system's data.

Hi! I’m here to help you understand CVE-2025-12925. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70