CVE-2025-24968 Business Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgine

High 8.8 Published 4 Feb 2025 Updated 4 Feb 2025

Attackers with specific roles can delete all projects, triggering a system takeover via the onboarding page to modify admin users and settings.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-24968?

CVE-2025-24968 is a high-severity vulnerability in yogeshojha rengine, published on 4 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, such as `penetration_tester` or `auditor` to delete all projects in the system. This can lead to a complete system takeover by redirecting the attacker to the onboarding page, where they can add or modify users, including Sys Admins, and configure critical settings like API keys and user preferences. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.

Weakness: CWE-284

Which versions are affected by CVE-2025-24968?

It affects 1 product.

Products include Yogeshojha Rengine.

How do I fix CVE-2025-24968?

No fix has been published for CVE-2025-24968 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-24968 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24968 exists.

Sources

Also known as GHSA-3327-6x79-q396.