CVE-2025-67919

MediumCVSS 6.5

Published: 08/01/2026(UTC)Updated: 07/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core (woffice-core) allows exploiting incorrectly configured access control security levels. This issue affects Woffice Core versions up to and including 5.4.30.

Risk Assessment

An attacker could bypass authorization mechanisms and gain access to functions or data they are not entitled to.

Recommendation

Update the Woffice Core plugin to a version newer than 5.4.30 once a fix becomes available.

Other vulnerabilities in Woffice Core

CVE-2025-67566Medium
The Woffice Core plugin (woffice-core) by WofficeIO has a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 5.4.30.

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS