CVE-2025-67793 Privilege escalation in n/a

Critical 9.8 Published 17 Dec 2025 Updated 18 Dec 2025

Users with role management privileges can escalate to Supervisor via API, impacting cloud multi-tenant deployments.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-67793?

CVE-2025-67793 is a critical vulnerability in n/a, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.

Weakness: CWE-269

Which versions are affected by CVE-2025-67793?

It affects 1 product.

Products include Drivelock Drivelock.

How do I fix CVE-2025-67793?

No fix has been published for CVE-2025-67793 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-67793 being exploited?

There is no known exploitation of CVE-2025-67793 in the wild and no public exploit code.

Sources

Also known as GHSA-xm5x-8w7p-rfr8.