CVE-2025-40619 Improper access control vulnerability in Bookgy
Unauthenticated attackers can access private areas and functions intended for other roles due to improper authorization controls in Bookgy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40619?
CVE-2025-40619 is a critical missing authorization vulnerability in Bookgy, published on 29 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to reach private areas and/or areas intended for other roles.
Weakness: CWE-863
Which versions are affected by CVE-2025-40619?
It affects 1 product.
Products include Bookgy Bookgy.
How do I fix CVE-2025-40619?
No fix has been published for CVE-2025-40619 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-40619 being exploited?
There is no known exploitation of CVE-2025-40619 in the wild and no public exploit code.
Other vulnerabilities in Bookgy
Sources
Also known as GHSA-3255-g96h-946g.