CVE-2025-49829 Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations

Medium 6.0 Published 15 Jul 2025 Updated 4 Nov 2025

Authenticated attackers can inject resources and bypass permission checks in Conjur secrets management systems due to missing validations.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-49829?

CVE-2025-49829 is a medium-severity missing authorization vulnerability in cyberark conjur, published on 15 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and to bypass permission checks. This issue affects Secrets Manager, Self-Hosted (formerly Conjur Enterprise) prior to versions 13.5.1 and 13.6.1 and Conjur OSS prior to version 1.22.1. Conjur OSS version 1.22.1 and Secrets Manager, Self-Hosted versions 13.5.1 and 13.6.1 fix the issue.

Weakness: CWE-862

Which versions are affected by CVE-2025-49829?

It affects 1 product.

Products include Cyberark Conjur.

How do I fix CVE-2025-49829?

No fix has been published for CVE-2025-49829 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-49829 being exploited?

There is no known exploitation of CVE-2025-49829 in the wild and no public exploit code.

Sources

Also known as GHSA-9w76-m74g-4c2r.