CVE-2025-48827
Published: 27 May 2025
Summary
CVE-2025-48827 is a critical-severity Improper Protection of Alternate Path (CWE-424) vulnerability in Vbulletin Vbulletin. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 1.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
vBulletin versions 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an access-control flaw that permits unauthenticated callers to reach protected API controller methods when the software runs on PHP 8.1 or later. The issue is triggered by supplying a protected method name directly to the /api.php endpoint, bypassing the normal authorization checks that the application relies on for its internal controllers.
An unauthenticated remote attacker can therefore invoke arbitrary protected functionality, resulting in full compromise of the vBulletin installation. The vulnerability carries a CVSS 3.1 score of 10.0 with network attack vector, no required credentials or user interaction, and complete impact on confidentiality, integrity, and availability under changed scope.
The flaw was observed being exploited in the wild during May 2025. Its EPSS score has reached a peak of 0.8108 and currently stands at 0.7763, indicating sustained attacker interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28267
Vulnerability details
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documenting requirements and authorizing remote access ensures proper protection of alternate paths.