CVE-2025-63687

MediumCVSS 6.5

Published: 07/11/2025(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

An issue was discovered in rymcu forest through commit f782e85 (2025-09-04) in the doBefore function in src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized attackers to delete arbitrary users' posts.

Risk Assessment

An authenticated attacker could delete other users' posts, compromising data integrity and content availability. The risk affects community platforms based on rymcu forest.

Recommendation

Update rymcu forest to a patched version or implement additional authorization checks in AuthorshipAspect. Review the authorization logic for post deletion operations.

Other vulnerabilities in rymcu forest

CVE-2025-12924Medium
A missing authorization vulnerability was identified in rymcu forest in the GlobalResult function of src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The attack can be initiated remotely. The product uses a rolling release model, so no specific version information is available.

Original NVD description (English source)

An issue was discovered in rymcu forest thru commit f782e85 (2025-09-04) in function doBefore in file src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized attackers to delete arbitrary users posts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS