CVE-2025-14025
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-14025 is a high-severity Incorrect Execution-Assigned Permissions (CWE-279) vulnerability. Its CVSS base score is 8.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique File and Directory Permissions Modification (T1222); ranked at the 33th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-14025 is a vulnerability in Ansible Automation Platform (AAP) involving read-only scoped OAuth2 API tokens. These tokens are enforced at the Gateway level only for Gateway-specific operations, but the flaw allows them to perform write operations on backend services such as Controller, Hub, and EDA. Exploitation is constrained by role-based access controls (RBAC). The issue is rated with a CVSS v3.1 base score of 8.5 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-279 (Incorrect Implementation of Authentication and Session Management).
An attacker with low privileges, such as one possessing a read-only OAuth2 API token, can exploit this over the network with high attack complexity and no user interaction required. Successful exploitation enables write operations on AAP backend services beyond the intended read-only scope, with the attacker's impact limited solely by their RBAC permissions. This results in high confidentiality, integrity, and availability impacts across a changed scope.
Red Hat advisories, including the security article at https://access.redhat.com/articles/7136004 and errata RHSA-2026:0360, RHSA-2026:0361, RHSA-2026:0408, and RHSA-2026:0409, address the vulnerability through updated packages for affected AAP components. Security practitioners should apply these patches promptly to enforce proper token scoping across all services.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1455
Vulnerability Data
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller,…
more
Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 2 hardening rules · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Enforcing approved authorizations structurally stops the runtime assignment of permissions that violate user intent.
Requiring least privilege limits the permissions the executing code is allowed to assign.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Restricting privileged utility programs reduces the chance that such tools will incorrectly alter object permissions.
Privileged access rights management directly constrains the permissions a process may assign at runtime.
Secure coding practices can prevent the coding error that leads to incorrect permission assignment.
Information access restriction policies limit the permissions that executing code can grant or modify.
Change-management procedures can catch permission-setting mistakes before they reach production.