CVE-2025-61119 Missing authorization in n/a
Attackers can manipulate API parameters to access unauthorized user details and group entry codes in the Kanova Android app.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-61119?
CVE-2025-61119 is a high-severity missing authorization vulnerability in n/a, published on 30 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful exploitation could result in privacy breaches, unauthorized group access, and misuse of the platform.
Weakness: CWE-284
Which versions are affected by CVE-2025-61119?
How do I fix CVE-2025-61119?
No fix has been published for CVE-2025-61119 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-61119 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61119 exists.
Sources
Also known as GHSA-rjr4-6p27-h332.