CVE-2025-68571

MediumCVSS 5.3

Published: 24/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

The SALESmanago & Leadoo plugin (up to version 3.9.0) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can leverage this to perform unauthorized actions.

Risk Assessment

The organization is exposed to unauthorized access to plugin functionality, potentially leading to data compromise or unauthorized changes.

Recommendation

Update the SALESmanago & Leadoo plugin to the latest version if available, and review access control configuration.

Other vulnerabilities in SALESmanago & Leadoo

CVE-2026-54822High
Subscriber SQL Injection vulnerability in SALESmanago and Leadoo versions up to 3.11.2 allows unauthorized access to the database through malicious SQL query injection.

Original NVD description (English source)

Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.9.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS