CVE-2025-54461

MediumCVSS 5.3

Published: 16/10/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

24th percentile - higher than 24% of all known CVEs

Summary

ChatLuck contains an insufficient granularity of access control vulnerability in the Invitation of Guest Users feature. If exploited, an uninvited guest user may register itself as a guest user.

Risk Assessment

Unauthorized individuals may gain access to the ChatLuck environment as guests, potentially leading to information leakage or unwanted access to resources. This violates the organization's access control assumptions.

Recommendation

Update ChatLuck to a version containing the access control fix for guest invitations. Review the list of active guest accounts and remove any unauthorized ones.

Other vulnerabilities in ChatLuck

CVE-2025-58115Medium
ChatLuck contains a cross-site scripting (XSS) vulnerability in the Guest User Sign-up feature. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.

Original NVD description (English source)

ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users. If exploited, an uninvited guest user may register itself as a guest user.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS