CVE-2025-70363
Published: 06 March 2026
Summary
CVE-2025-70363 is a high-severity Improper Access Control (CWE-284) vulnerability in Ibexa Ez Platform. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-70363 is an incorrect access control vulnerability (CWE-284) in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x. Published on 2026-03-06T17:16:25.063, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high severity due to significant confidentiality impact.
Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction or privileges required. By enumerating object IDs, they can access sensitive data exposed through the REST API.
Mitigation details are available in advisories referenced at http://ez.com, http://ibexa.com, and https://gist.github.com/zywsec/a2bd04864895c8fd6d73dcf14a1f7607.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208341
Vulnerability details
Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive data via enumerating object IDs.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Incorrect access control in public REST API directly enables remote unauthenticated exploitation of a public-facing application to access sensitive data.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 enforces approved authorizations for access to system resources, directly mitigating the incorrect access control that permits unauthenticated enumeration of sensitive data via the REST API.
SC-14 requires restrictions on publicly accessible interfaces to prevent unauthorized access to sensitive functions and data, addressing the exposed REST API vulnerability.
AC-14 limits and documents permitted actions without authentication, preventing unauthenticated attackers from accessing sensitive data through object ID enumeration.