CVE-2025-46203
Changeweb Unifiedtransform 2.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NSummary
CVE-2025-46203 is a medium-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Changeweb Unifiedtransform. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-2 (Account Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16924
Vulnerability Data
An issue in Unifiedtransform v2.0 allows a remote attacker to escalate privileges via the /students/edit/{id} endpoint.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Incorrect access control in Unifiedtransform v2.0 allows authenticated low-privileged users (students/teachers) to access the /students/edit/{id} endpoint and modify student records intended for admins only, facilitating exploitation for privilege escalation (T1068), account manipulation (T1098), and stored data manipulation (T1565.001).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization checks on the /students/edit/{id} endpoint so that only properly assigned users may modify student records.
Requires that accounts and roles are provisioned with only the minimum privileges needed, reducing the impact of incorrect privilege assignments that enable the escalation.
Ensures that user accounts and their associated privileges for student data are created, reviewed, and revoked according to defined policy, limiting opportunities for erroneous privilege grants.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy definition, management, and review that prevents incorrect privilege assignments.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The access-rights control governs the entire lifecycle of privilege assignment, directly eliminating incorrect assignments.
Privileged-access-rights control explicitly requires least-privilege assignment and ongoing validation, directly mitigating CWE-266.
Access control policy directly prevents incorrect privilege assignment by defining who may receive which rights.
Segregation of duties reduces blast radius of any single incorrect privilege but does not prevent the assignment itself.
Restricting privileged utility programs limits exposure from over-privileged accounts but does not address how privileges are assigned.
Information-access-restriction mechanisms enforce the correct privilege boundaries once assignment rules are defined.