CVE-2025-62180
HighCVSS 7.1Summary
Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data, potentially leading to privacy breaches and information security issues.
Recommendation
It is recommended to update Pega Platform to the latest version to mitigate this authorization weakness and review user access policies.
Other vulnerabilities in Pega Platform
See all- CVE-2026-13761High
Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
- CVE-2026-10754High
Pega Platform versions 8.5.0 through 25.1.2 have an improper validation of cryptographic signatures issue, which may allow an attacker to bypass security controls.
- CVE-2026-14337Medium
Pega Platform versions 23.1.0 through 25.1.3 are affected by a Stored Cross-site Scripting (XSS) vulnerability in a user interface component. It requires a high privileged user with a developer role.
- CVE-2026-1563Medium
Reflected XSS vulnerability in Pega Platform versions 8.1.0 through 25.1.2 affects a user interface component. Requires a high privileged user with a developer role.
- CVE-2026-1562Medium
Stored XSS vulnerability in Pega Platform versions 8.1.0 through 25.1.2 affects a user interface component. Requires a high privileged user with a developer role.
- CVE-2025-62184Low
Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. The attack requires administrative user privileges and extensive access rights, with low impact on confidentiality and no impact on integrity.
Original NVD description (English source)
Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.