CVE-2025-13084
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-26

Last updated on: 2025-11-26

Assigner: ICS-CERT

Description
The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-26
Last Modified
2025-11-26
Generated
2026-06-16
AI Q&A
2025-11-26
EPSS Evaluated
2026-06-15
NVD
CVE-2025-13084
EUVD
EUVD-2025-199744
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
groov view_api 4.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1230 The product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability occurs in the groov View API's users endpoint, which returns a list of all users along with their associated metadata, including their API keys. Access to this endpoint requires an Editor role, but it exposes API keys for all users, including Administrators, potentially allowing unauthorized access or misuse of these keys.

Impact Analysis

The vulnerability can lead to unauthorized disclosure of API keys for all users, including administrators. This could allow attackers or unauthorized users with Editor role access to misuse these keys, potentially leading to unauthorized access, data breaches, or manipulation of the system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-13084. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart