Authorization Bypass in Viafirma Documents v3.7.129 Enables Privilege Escalation

Publication date: 2026-01-12

Last updated on: 2026-01-12

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description

Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-12

Last Modified

2026-01-12

Generated

2026-07-06

AI Q&A

2026-01-13

EPSS Evaluated

2026-07-05

NVD

CVE-2025-41078

Affected Vendors & Products

Vendor	Product	Version / Range
viafirma	documents	3.7.129
viafirma	inbox	to 4.5.27 (exc)
viafirma	inbox	4.5.27

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Viafirma Documents v3.7.129 involves weaknesses in the authorization mechanisms that allow an authenticated user without privileges to list and access other users' data. Additionally, such a user can use features for creating, modifying, and deleting users, and escalate privileges by impersonating other users during document generation and signing.

Impact Analysis

The vulnerability can lead to unauthorized access to other users' data, unauthorized user management actions (creation, modification, deletion), and privilege escalation through user impersonation. This can result in data breaches, unauthorized document signing, and potential misuse of the application by attackers.

Hi! I’m here to help you understand CVE-2025-41078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70