CVE-2025-62527
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Taguette is an open source qualitative research tool. An issue has been discovered in versions prior to 1.5.0 where an attacker could request a password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This has been patched in version 1.5.0.
Risk Assessment
An attacker could take over a victim's account by changing the email address, potentially leading to unauthorized access to research data.
Recommendation
Update Taguette to version 1.5.0 or later and be cautious when clicking links in emails.
Other vulnerabilities in Taguette
See all- CVE-2025-67502Medium
Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without any validation. This can be exploited for phishing attacks where victims believe they are interacting with a trusted Taguette instance but are redirected to a malicious site designed to steal credentials or deliver malware. This issue is fixed in version 1.5.2.
- CVE-2025-62528Medium
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0.
Original NVD description (English source)
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been patched in version 1.5.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS