CVE-2025-70148 Missing authorization in n/a

High 7.5 Published 18 Feb 2026 Updated 8 Sep 2026

Unauthenticated attackers can access arbitrary user membership card data via IDOR in CodeAstro Membership Management System.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-70148?

CVE-2025-70148 is a high-severity missing authorization vulnerability in n/a, published on 18 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card data of arbitrary users via direct requests with a manipulated id parameter, resulting in insecure direct object reference (IDOR).

Weakness: CWE-862

Which versions are affected by CVE-2025-70148?

It affects 1 product.

Products include Codeastro Membership Management System.

How do I fix CVE-2025-70148?

No fix has been published for CVE-2025-70148 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2025-70148 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-70148 exists.

Sources

Also known as GHSA-7fjm-558r-4j8r.