CVE-2025-0783 pankajindevops scale API Endpoint access control
Remote attackers can bypass access controls on the API endpoint of pankajindevops scale due to improper authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0783?
CVE-2025-0783 is a medium-severity missing authorization vulnerability in pankajindevops scale, published on 28 Jan 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability, which was classified as problematic, was found in pankajindevops scale up to 20241113. This affects an unknown part of the component API Endpoint. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. This product does not use versioning. This is why information about affected and unaffected releases are unavailable.
Which versions are affected by CVE-2025-0783?
How do I fix CVE-2025-0783?
No fix has been published for CVE-2025-0783 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-0783 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-0783 exists.
Sources
Also known as GHSA-cwp3-3mxc-v33w.