CVE-2025-27101 Broken Access Control in Opal filesystem's copy functionality exposes all user data
Low-privilege users can copy parent directories to temp folders, exposing all user data and bypassing access controls in the Opal biobank application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27101?
CVE-2025-27101 is a high-severity missing authorization vulnerability in obiba opal, published on 11 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of the application are impacted, as this is exploitable by any user to reveal all files in the opal filesystem. This also means that low-privilege users such as DataShield users can retrieve the files of other users. Version 5.1.1 contains a patch for the issue.
Weakness: CWE-22
Which versions are affected by CVE-2025-27101?
How do I fix CVE-2025-27101?
No fix has been published for CVE-2025-27101 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-27101 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-27101 exists.
Sources
Also known as AZL-62432, GHSA-rxmx-gqjj-vhv8.