CVE-2025-66906
CSRF Vulnerability in Turms Admin API Allows Privilege Escalation
Publication date: 2025-12-19
Last updated on: 2025-12-19
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| turms | admin_api | 0.10.0-snapshot |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross Site Request Forgery (CSRF) issue in the Turms Admin API up to version 0.10.0-SNAPSHOT. It allows attackers to perform unauthorized actions by tricking authenticated users into submitting malicious requests, which can lead to attackers gaining escalated privileges within the system.
How can this vulnerability impact me? :
The vulnerability can allow attackers to escalate their privileges by exploiting the CSRF flaw, potentially gaining unauthorized administrative access or control over the Turms Admin API. This can lead to unauthorized changes, data exposure, or manipulation within the affected system.