CVE-2025-26370
Published: 12 February 2025
Summary
CVE-2025-26370 is a high-severity Missing Authorization (CWE-862) vulnerability in Q-Free Maxtime. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 35.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-2 (Account Management).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates enforcement of approved authorizations for access to system resources, preventing low-privileged attackers from modifying user group privileges via crafted HTTP requests.
Enforces least privilege to restrict low-privileged users from performing unauthorized privilege modifications on user groups.
Establishes account management processes to control privilege assignments and changes, mitigating risks of unauthorized alterations to user groups.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authorization allows low-privileged authenticated attackers to remove privileges from user groups via crafted HTTP requests to the exposed web management interface, enabling exploitation for privilege escalation (T1068, T1210), account manipulation (T1098), and account access removal (T1531).
NVD Description
A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove privileges from user groups via crafted HTTP requests.
Deeper analysisAI
CVE-2025-26370 is a CWE-862 Missing Authorization vulnerability in the maxprofile/user-groups/routes.lua component of Q-Free MaxTime versions less than or equal to 2.11.0. It enables an authenticated low-privileged attacker to remove privileges from user groups through crafted HTTP requests. The vulnerability carries a CVSS v3.1 base score of 7.1, with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, indicating network accessibility, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.
An authenticated attacker with low privileges can exploit this vulnerability remotely by sending specially crafted HTTP requests to the affected endpoint. Successful exploitation allows the attacker to strip privileges from user groups, potentially escalating control over the system by demoting other users or groups, disrupting access controls, and enabling further unauthorized actions within the MaxTime environment.
For mitigation details, refer to the advisory published by Nozomi Networks at https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-26370.
Details
- CWE(s)