CVE-2025-50870 Missing authorization in n/a
Attackers can retrieve sensitive student personal information by manipulating email parameters without proper authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-50870?
CVE-2025-50870 is a critical missing authorization vulnerability in n/a, published on 1 Aug 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the requesting user. This allows any authenticated or unauthenticated attacker to enumerate and retrieve sensitive student details by altering the email value in the request URL, leading to information disclosure.
Weakness: CWE-284
Which versions are affected by CVE-2025-50870?
How do I fix CVE-2025-50870?
No fix has been published for CVE-2025-50870 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-50870 being exploited?
There is no known exploitation of CVE-2025-50870 in the wild and no public exploit code.
Sources
Also known as GHSA-fmhj-j6r9-5m2p.