CVE-2025-20114 Cisco Unified Intelligence Center Insecure Direct Object Reference Vulnerability

Medium 4.3 Published 21 May 2025 Updated 26 Feb 2026

Authenticated attackers can access other users' data via insecure direct object reference in the API, requiring a patch.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-20114?

CVE-2025-20114 is a medium-severity missing authorization vulnerability in Cisco Unified Contact Center Express, published on 21 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the API of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to perform a horizontal privilege escalation attack on an affected system. This vulnerability is due to insufficient validation of user-supplied parameters in API requests. An attacker could exploit this vulnerability by submitting crafted API requests to an affected system to execute an insecure direct object reference attack. A successful exploit could allow the attacker to access specific data that is associated with different users on the affected system.

Weakness: CWE-639

Which versions are affected by CVE-2025-20114?

It affects 2 products.

Products include Cisco Unified Contact Center Express, Cisco Unified Intelligence Center.

How do I fix CVE-2025-20114?

No fix has been published for CVE-2025-20114 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-20114 being exploited?

There is no known exploitation of CVE-2025-20114 in the wild and no public exploit code.

Sources

Also known as GHSA-9r82-ff34-6w3x.