Cyber Resilience

CVE-2025-49591

HighPublic PoC

Published: 18 June 2025

Published
18 June 2025
Modified
11 August 2025
KEV Added
Patch
CVSS Score v4 7.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0032 55.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-49591 is a high-severity Improper Access Control (CWE-284) vulnerability in Xwiki Cryptpad. Its CVSS base score is 7.4 (High).

Operationally, ranked in the top 44.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's…

more

account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

xwiki
cryptpad
≤ 2025.3.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-284 CWE-287

The awareness and training policy mandates training on access control practices, directly reducing the likelihood of improper access control weaknesses being introduced or exploited.

addresses: CWE-284 CWE-287

Training covers access control policies and the consequences of improper access grants or usage by users.

addresses: CWE-284 CWE-287

Security training teaches access control policies and enforcement, reducing improper access control implementations.

addresses: CWE-284 CWE-287

Provides capability to review session content, directly detecting violations of access control.

addresses: CWE-284 CWE-287

System audit review detects violations of access controls by identifying unauthorized access attempts.

addresses: CWE-284 CWE-287

Control assessments verify that access controls are implemented correctly and operating as intended, detecting improper access control before exploitation.

addresses: CWE-284 CWE-287

Requiring formal approval, documented controls, and responsibilities for inter-system exchanges directly enforces proper access control between systems.

addresses: CWE-284 CWE-287

Penetration testing simulates unauthorized access attempts, directly detecting and enabling remediation of improper access control weaknesses.

References