CVE-2025-59714 Missing authorization in Grouper
Group admins can improperly configure loader jobs, allowing unauthorized modification of system configurations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59714?
CVE-2025-59714 is a medium-severity missing authorization vulnerability in Internet2 Grouper, published on 19 Sep 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs.
Weakness: CWE-863
Which versions are affected by CVE-2025-59714?
It affects 1 product.
Products include Internet2 Grouper.
How do I fix CVE-2025-59714?
No fix has been published for CVE-2025-59714 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-59714 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59714 exists.
Other vulnerabilities in Internet2 Grouper
Sources
Also known as GHSA-9w3p-67mx-gphr.