CVE-2025-40667 Missing authorization vulnerability in TCMAN GIM v11

High 8.7 Published 26 May 2025 Updated 27 May 2025

Authenticated attackers can bypass UI restrictions to access unauthorized application functionality by modifying HTTP response codes and hidden fields.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-40667?

CVE-2025-40667 is a high-severity missing authorization vulnerability in TCMAN GIM, published on 26 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Missing authorization vulnerability in TCMAN's GIM v11. This allows an authenticated attacker to access any functionality of the application even when they are not available through the user interface. To exploit the vulnerability the attacker must modify the HTTP code of the response from ‘302 Found’ to ‘200 OK’, as well as the hidden fields hdnReadOnly and hdnUserLogin.

Weakness: CWE-862

Which versions are affected by CVE-2025-40667?

It affects 1 product.

Products include Tcman Gim.

How do I fix CVE-2025-40667?

No fix has been published for CVE-2025-40667 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-40667 being exploited?

There is no known exploitation of CVE-2025-40667 in the wild and no public exploit code.

Sources

Also known as GHSA-4cf8-482q-v686.