CVE-2025-33137 IBM Aspera Faspex data modification

High 7.1 Published 22 May 2025 Updated 26 Aug 2025

Authenticated users can access sensitive data or modify other users' data due to client-side security enforcement flaws in IBM Aspera Faspex.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-33137?

CVE-2025-33137 is a high-severity missing authorization vulnerability in IBM Aspera Faspex, published on 22 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security.

Weakness: CWE-602

Which versions are affected by CVE-2025-33137?

It affects 1 product.

Products include Ibm Aspera Faspex.

How do I fix CVE-2025-33137?

No fix has been published for CVE-2025-33137 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-33137 being exploited?

There is no known exploitation of CVE-2025-33137 in the wild and no public exploit code.

Sources

Also known as GHSA-w6gx-hfp5-rmhr.