BaseFortify

Publication date: 2025-11-03

Last updated on: 2026-07-05

Assigner: MITRE

Description

FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-03

Last Modified

2026-07-05

Generated

2026-07-06

AI Q&A

2025-11-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-63293

EUVD

EUVD-2025-37516

Affected Vendors & Products

Vendor	Product	Version / Range
fairsketch	rise_ultimate_project_manager	3.9.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

FairSketch Rise Ultimate Project Manager & CRM 3.9.4 has a vulnerability called Insecure Permissions. This means that a remote authenticated user can add comments or upload attachments to tickets even if they do not have permission to view or edit those tickets. This happens because the system does not properly check if the user is authorized to perform these actions in the ticketing/commenting API.

Impact Analysis

This vulnerability can allow unauthorized users to modify ticket data by appending comments or uploading attachments without proper permissions. This could lead to information tampering, misinformation, or unauthorized data being added to tickets, potentially disrupting workflows or causing confusion.

Hi! I’m here to help you understand CVE-2025-63293. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70