CVE-2025-8756
Published: 09 August 2025
Summary
CVE-2025-8756 is a low-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Tduckcloud Tduck-Platform. Its CVSS base score is 2.1 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 45.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-24 (Access Control Decisions).
Deeper analysis
CVE-2025-8756 is an improper authorization vulnerability classified as critical in TDuckCloud tduck-platform versions up to 5.1. The issue affects the preHandle function in the /manage/ file of the com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor component. Published on 2025-08-09, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) and maps to CWEs 266 (Incorrect Privilege Assignment) and 285 (Improper Authorization).
An attacker with low privileges can exploit this vulnerability remotely by manipulating the affected function, bypassing authorization controls. The attack requires network access and low complexity with no user interaction, enabling limited impacts: low confidentiality (C:L), integrity (I:L), and availability (A:L) effects within the unscoped scope (S:U).
Advisories and further details are documented in the TDuckCloud tduck-platform GitHub repository at https://github.com/TDuckCloud/tduck-platform/issues/28 (including comment https://github.com/TDuckCloud/tduck-platform/issues/28#issue-3269885235) and VulDB entries such as https://vuldb.com/?ctiid.319261, https://vuldb.com/?id.319261, and https://vuldb.com/?submit.624188. The exploit has been publicly disclosed and may be used.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24054
Vulnerability details
A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of the file /manage/ of the component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor. The manipulation leads to improper authorization. The attack can…
more
be launched remotely. The exploit has been disclosed to the public and may be used.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote authorization bypass in a public-facing web application interceptor enables exploitation of the exposed service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces authorization decisions in the AuthorizationInterceptor preHandle function to block the improper authorization bypass.
Limits privileges assigned to accounts so that successful exploitation of the CWE-266 flaw yields only minimal impact.
Ensures access control decisions are made and enforced before allowing access to the /manage/ component.