CVE-2025-59797 Missing authorization in Profession Fit
Attackers can bypass authorization to access sensitive API endpoints and user management pages in Profession Fit.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59797?
CVE-2025-59797 is a medium-severity missing authorization vulnerability in Profession Fit, published on 22 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management page, and the plane page.
Weakness: CWE-425
Which versions are affected by CVE-2025-59797?
How do I fix CVE-2025-59797?
No fix has been published for CVE-2025-59797 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-59797 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59797 exists.
Sources
Also known as GHSA-rhvx-hr6c-q6qj.