CVE-2025-11581 PowerJob OpenAPIController runJob authorization

What is CVE-2025-11581?

CVE-2025-11581 is a medium-severity missing authorization vulnerability in PowerJob, published on 10 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A security vulnerability has been detected in PowerJob up to 5.1.2. This vulnerability affects unknown code of the file /openApi/runJob of the component OpenAPIController. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Weakness: CWE-863, CWE-862

Which versions are affected by CVE-2025-11581?

2 open source packages ship an affected version, including tech.powerjob:powerjob-server-starter. It affects 1 product.

Products include Powerjob Powerjob.

How do I fix CVE-2025-11581?

No fix has been published for CVE-2025-11581 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-11581 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11581 exists.

Other vulnerabilities in PowerJob

• CVE-2024-44546 SQL injection in n/a Critical 9.8
• CVE-2023-37754 Code injection in PowerJob Critical 9.8
• CVE-2023-29924 PowerJob vulnerable to incorrect access control Critical 9.8
• CVE-2023-29926 PowerJob vulnerable to remote code execution Critical 9.8
• CVE-2023-36106 PowerJob incorrect access control vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9wq6-87hw-6mhc.