CVE-2025-14881

LowCVSS 3.8

Published: 19/12/2025(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

15th percentile - higher than 15% of all known CVEs

Summary

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

Risk Assessment

Unauthorized access to other users' files can lead to leakage of confidential information. This may violate privacy and data security.

Recommendation

Update the software to a version containing the fix. Implement additional authorization checks for file access.

Other vulnerabilities in API

CVE-2025-58580Medium
An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.

Original NVD description (English source)

Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS