CVE-2025-0326
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. As a result, previously issued tokens remain active even after the user's access context has been modified or revoked.
Risk Assessment
This could lead to unauthorized access by a malicious actor, but only when previously issued access tokens remain active and have been exposed to malicious actors.
Recommendation
Apply the vendor patch that ensures token invalidation during account management operations and revoke existing tokens if needed.
Other vulnerabilities in System
See all- CVE-2026-22909High
Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations.
- CVE-2026-56888Medium
In multiple locations, a permission bypass is possible due to side channel information disclosure. This could lead to local privilege escalation without additional execution privileges or user interaction.
- CVE-2026-55332Medium
In multiple locations, an out-of-bounds write is possible due to improper input validation. This could lead to local privilege escalation requiring System execution privileges.
- CVE-2026-9651Medium
CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability could cause unauthorized disclosure of password hashes. An attacker with privileged local access can read improperly protected system files, potentially leading to account compromise.
- CVE-2026-49190High
The system fails to evaluate instructional permissions over multiple internal operation codes (opcodes), permitting unauthorized application installations or command executions.
- CVE-2025-59460High
The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections.
- CVE-2023-35691High
There is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with System execution privileges needed.
Original NVD description (English source)
The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account management operations such as password reset, role change, or sub-organization disablement. This oversight allows previously issued tokens to remain active even after the user's access context has been modified or revoked through administrative actions. The identified issue could lead to unauthorized access by a malicious actor, but only when all of the following conditions are met: previously issued access tokens remain active, and these tokens have been exposed to malicious actors.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS