CVE-2025-11580 PowerJob list authorization

Medium 6.9 Published 10 Oct 2025 Updated 24 Feb 2026

Remote attackers can access user list data without proper authorization in PowerJob, exposing sensitive information.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-11580?

CVE-2025-11580 is a medium-severity missing authorization vulnerability in PowerJob, published on 10 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

Weakness: CWE-863, CWE-862

Which versions are affected by CVE-2025-11580?

2 open source packages ship an affected version, including tech.powerjob:powerjob. It affects 1 product.

Package	Affected	Fixed in
`tech.powerjob:powerjob` Maven	All versions to `5.1.2`	None
`tech.powerjob:powerjob` Maven	All versions to `5.1.2`	None

Products include Powerjob Powerjob.

How do I fix CVE-2025-11580?

No fix has been published for CVE-2025-11580 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-11580 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11580 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-87xj-ghmc-c3xq.