CVE-2025-24024
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-24024 is a critical-severity Lack of Administrator Control over Security (CWE-671) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and CM-7 (Least Functionality) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-24024 is a high-severity vulnerability (CVSS 9.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) affecting Mjolnir version 1.9.0, an open-source moderation bot for Matrix servers. The flaw stems from the bot responding to management commands issued from any room it is a member of, rather than restricting them to authorized operator rooms. This misconfiguration enables unauthorized access to the bot's full range of functions, including potentially sensitive server administration capabilities if those components are enabled (CWE-671: Unauthorized Control Sphere Application Violation).
Any user present in a room where the Mjolnir bot v1.9.0 is joined can exploit this vulnerability remotely over the network with low complexity and no required privileges or user interaction. Attackers can issue arbitrary management commands to manipulate the bot's behavior, such as banning users, modifying room configurations, or executing server-level administrative actions if configured, leading to significant integrity and availability impacts.
Mitigation involves upgrading to Mjolnir version 1.9.1, which reverts the problematic feature, or version 1.9.2, which reintroduces it with proper safeguards. If upgrading to 1.9.1 or later is not feasible, administrators should downgrade to version 1.8.3. Details are available in the GitHub security advisory (GHSA-3jq6-xc85-m394) and related commits (b437fa16 and d0ef527a).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3597
Vulnerability Data
Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 responds to management commands from any room the bot is member of. This can allow users who aren't operators of the bot to use the bot's functions, including server administration components…
more
if enabled. Version 1.9.1 reverts the feature that introduced the bug, and version 1.9.2 reintroduces the feature safely. Downgrading to version 1.8.3 is recommended if upgrading to 1.9.1 or higher isn't possible.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandating documented configuration settings that reflect restrictive modes directly requires the product to expose tunable security parameters to administrators.
Requiring configuration of least functionality forces the product to let administrators restrict or enable features rather than hard-coding them.
Least-privilege assignment presupposes that administrators can grant or withhold specific privileges instead of having them fixed by the product.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-671, a class-level weakness, and none of its children carries one either.