CVE-2025-15235
Unknown Unknown - Not Provided
Missing Authorization in QOCA AI Medical Cloud Enables File Access

Publication date: 2026-01-05

Last updated on: 2026-01-05

Assigner: TWCERT/CC

Description
QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to modify specific network packet parameters, enabling certain system functions to access other users' files.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-05
Last Modified
2026-01-05
Generated
2026-06-16
AI Q&A
2026-01-05
EPSS Evaluated
2026-06-15
NVD
CVE-2025-15235
EUVD
EUVD-2026-0906
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
quanta_computer qoca_aim_ai_medical_cloud_platform to 2.7.6 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows authenticated remote attackers to access files belonging to other users, which could lead to unauthorized disclosure of sensitive data. This high confidentiality impact may result in non-compliance with data protection regulations such as GDPR and HIPAA that require strict controls on access to personal and medical information. Therefore, the vulnerability poses a risk to compliance with these standards until it is remediated. [1, 2]

Executive Summary

CVE-2025-15235 is a Missing Authorization vulnerability in the QOCA aim AI Medical Cloud Platform (version 2.7.5 and earlier). It allows authenticated remote attackers to modify specific network packet parameters, which enables certain system functions to access files belonging to other users without proper authorization. [1, 2]

Impact Analysis

This vulnerability can impact you by allowing attackers with valid credentials to access confidential files of other users within the system, leading to a high confidentiality breach. However, it does not affect data integrity or system availability. [1, 2]

Mitigation Strategies

The immediate step to mitigate this vulnerability is to update the QOCA aim AI Medical Cloud Platform to version 2.7.6 or later, as this resolves the Missing Authorization vulnerability allowing authenticated remote attackers to modify network packet parameters and access other users' files. [1, 2]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-15235. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart