CVE-2025-67796
Authorization Bypass in IKUS Rdiffweb
Publication date: 2026-05-04
Last updated on: 2026-05-05
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ikus | rdiffweb | to 2.10.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
IKUS Rdiffweb before version 2.10.5 has an improper authorization vulnerability. This flaw allows an attacker who possesses any valid or stolen access token to impersonate other users. The API does not properly enforce a binding between the authenticated user and the targeted user or tenant, which means crafted requests can access or modify data belonging to other users. In some cases, the attacker may also perform privileged actions. This vulnerability can lead to unauthorized cross-tenant access.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized access to other users' data, modification of that data, and potentially performing privileged actions without proper authorization. It can lead to data breaches, loss of data integrity, and unauthorized control over user accounts or tenant resources. Cross-tenant access means that data from different customers or organizational units could be exposed or altered by attackers.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade IKUS Rdiffweb to version 2.10.6 or later, where the improper authorization flaw has been fixed.
Until the upgrade is applied, restrict access to the application to trusted users only and monitor for any suspicious activity involving access tokens.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker with any valid or stolen access token to act as other users, potentially reading or modifying other users' data and performing privileged actions. This improper authorization flaw may enable cross-tenant access.
Such unauthorized access and data modification could lead to violations of data protection regulations and standards like GDPR and HIPAA, which require strict controls on user data access and privacy.