CVE-2025-69415
Plex Media Server ≤ 1.42.2.10156
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-69415 is a high-severity Operation on a Resource after Expiration or Release (CWE-672) vulnerability in Plex Media Server. Its CVSS base score is 7.1 (High).
Operationally, ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-69415 affects Plex Media Server (PMS) through version 1.42.2.10156, where the ability to access the /myplex/account endpoint using a device token is not properly restricted based on whether the device is currently associated with an account. This represents an access control misalignment, classified under CWE-672 (operation on a resource after expiration or release). The vulnerability has a CVSS v3.1 base score of 7.1 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N), indicating high confidentiality impact with low integrity impact and no availability impact, in a changed scope scenario.
A low-privileged attacker (PR:L) with network access (AV:N) can exploit this issue, though it requires high attack complexity (AC:H) and no user interaction (UI:N). By leveraging a device token, the attacker can reach the /myplex/account endpoint even if the device is not actively associated with an account, potentially obtaining sensitive account information and achieving high confidentiality impact, with limited integrity modification possible.
For mitigation details, refer to the advisory at https://github.com/lufinkey/vulnerability-research/blob/main/CVE-2025-34158/README.md.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0039
Vulnerability Data
In Plex Media Server (PMS) through 1.42.2.10156, ability to access /myplex/account with a device token is not properly aligned with whether the device is currently associated with an account.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement applies current authorizations to every request, directly blocking operations once a resource has been revoked or released.
Authenticator management mandates revocation and replacement procedures that render expired credentials unusable.
Account lifecycle management includes explicit revocation and disabling steps that stop subsequent operations on released accounts or identifiers.
Identifier management requires deallocation and reuse controls that prevent continued use of released identifiers.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect use-after-release but does not prevent it at runtime.
Secure-coding rules require checks that prevent operations on freed or expired objects.
Change-management processes can introduce or remove resource-lifetime controls.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-672, a class-level weakness, and none of its children carries one either.