CVE-2025-31512 Auth bypass in n/a
Attackers can bypass manager approval for access requests by manipulating the requestSubmit API call in AlertEnterprise Guardian.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-31512?
CVE-2025-31512 is a high-severity authentication bypass vulnerability in n/a, published on 22 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in AlertEnterprise Guardian 4.1.14.2.2.1. One can bypass manager approval via isAddedByApprover in a Request%20Building%20Access requestSubmit API call. The vendor has stated that the system is protected by updating to a version equal to or greater than one of the following build numbers: 4.1.12.2.1.19, 4.1.12.5.2.36, 4.1.13.0.60, 4.1.13.2.0.3.39, 4.1.13.2.0.3.41, 4.1.13.2.42, 4.1.13.2.25.44, 4.1.14.0.13, 4.1.14.0.43, 4.1.14.0.48, and 4.1.14.1.5.32.
Weakness: CWE-288
Which versions are affected by CVE-2025-31512?
How do I fix CVE-2025-31512?
No fix has been published for CVE-2025-31512 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-31512 being exploited?
There is no known exploitation of CVE-2025-31512 in the wild and no public exploit code.
Sources
Also known as GHSA-qh6p-5f77-2v8v.