CVE-2025-12925 rymcu forest UserDicController.java deleteDic authorization
Remote attackers can manipulate dictionary functions without proper authorization, potentially reading or modifying data in the Forest application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12925?
CVE-2025-12925 is a medium-severity missing authorization vulnerability in rymcu forest, published on 10 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security flaw has been discovered in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. Impacted is the function getAll/addDic/getAllDic/deleteDic of the file src/main/java/com/rymcu/forest/lucene/api/UserDicController.java. The manipulation results in missing authorization. The attack may be launched remotely. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.
Which versions are affected by CVE-2025-12925?
It affects 1 product.
Products include Rymcu Forest.
How do I fix CVE-2025-12925?
No fix has been published for CVE-2025-12925 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-12925 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-12925 exists.
Other vulnerabilities in rymcu forest
- CVE-2023-51804 Server-side request forgery in n/a
- CVE-2025-63687 Missing authorization in n/a
- CVE-2025-12924 rymcu forest BankController.java GlobalResult authorization
- CVE-2026-2946 rymcu forest Article Content/Comments/Portfolio XssUtils.java XssUtils.replaceHtmlCode cross site scripting
- CVE-2026-2947 rymcu forest User Profile UserInfoController.java updateUserInfo cross site scripting
Sources
Also known as GHSA-c9jg-5vh8-ff2v.