CVE-2026-25427

MediumCVSS 5.4

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The eRoom plugin versions up to 1.7.1 contain a broken access control vulnerability, allowing subscribers unauthorized access to functions reserved for higher roles.

Risk Assessment

The risk involves privilege escalation by subscribers, potentially leading to unauthorized access to sensitive data or administrative functions.

Recommendation

Immediately update the eRoom plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in eRoom

CVE-2026-25405High
The eRoom plugin version 1.7.1 and earlier contains an SQL Injection vulnerability exploitable by users with Contributor role.

Original NVD description (English source)

Subscriber Broken Access Control in eRoom <= 1.7.1 versions.