CVE-2025-34293 GN4 Publishing System Insecure Direct Object Reference (IDOR) Information Disclosure
Authenticated users can access sensitive account data for other users via API, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34293?
CVE-2025-34293 is a high-severity vulnerability in Naviga Global / Miles 33 GN4 Publishing System, published on 24 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's object endpoints allow an authenticated user to request arbitrary user IDs and receive sensitive account data for those users, including the stored password and the account's security question and answer. The exposed recovery data and encrypted password may be used to reset or take over the target account.
Weakness: CWE-639
Which versions are affected by CVE-2025-34293?
How do I fix CVE-2025-34293?
No fix has been published for CVE-2025-34293 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34293 being exploited?
There is no known exploitation of CVE-2025-34293 in the wild and no public exploit code.
Sources
Also known as GHSA-x7wc-2853-87fv.