CVE-2025-13131
BaseFortify
Publication date: 2025-11-13
Last updated on: 2025-11-13
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sonarr | sonarr | 4.0.15.2940 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
| CWE-276 | During installation, installed file permissions are set to allow anyone to modify those files. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Sonarr 4.0.15.2940 involves incorrect default permissions set by an unknown function in the Service component (Sonarr.Console.exe). It requires local access and either an intentional change to a highly privileged service account or an attacker having admin-level access to exploit it. The vendor considers it low severity due to these constraints and plans to fix it in the next major release (v5).
How can this vulnerability impact me? :
If exploited, this vulnerability could allow an attacker with local and administrative access to gain elevated privileges or control over the Sonarr service due to incorrect default permissions. However, exploitation requires either intentional misconfiguration or admin-level access, limiting the risk to environments where such conditions exist.
What immediate steps should I take to mitigate this vulnerability?
Since the vulnerability involves incorrect default permissions in Sonarr 4.0.15.2940 and requires local access with at least a low privileged account, immediate mitigation steps include ensuring that the Sonarr service is not running under a highly privileged account, maintaining strict local access controls, and monitoring for any unauthorized changes to service permissions. Additionally, plan to upgrade to the next major release v5 when it becomes available, as it will include a fix for this issue.