CVE-2025-5182 Summer Pearl Group Vacation Rental Management Platform Listing authorization

Medium 5.3 Published 26 May 2025 Updated 28 May 2025

Attackers can bypass authorization checks in the Listing Handler to access restricted functionality remotely.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-5182?

CVE-2025-5182 is a medium-severity missing authorization vulnerability in Summer Pearl Group Vacation Rental Management Platform, published on 26 May 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability has been found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as critical. This vulnerability affects unknown code of the component Listing Handler. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.0.2 is able to address this issue. It is recommended to upgrade the affected component.

Weakness: CWE-639, CWE-285

Which versions are affected by CVE-2025-5182?

It affects 1 product.

Products include Summerpearlgroup Vacation Rental Management Platform.

How do I fix CVE-2025-5182?

No fix has been published for CVE-2025-5182 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-5182 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5182 exists.

Public exploit code: 1 proofs of concept on GitHub.

Sources

Also known as GHSA-rjv6-gj2v-mh9h.