CVE-2025-1091 MEDIUM

CVE-2025-1091: Broken Authorization Schema

Vendor Tenable
Product Tenable Identity Exposure
Weakness CWE-862 · Missing authorization
Published February 25, 2025
Last update February 26, 2025
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A Broken Authorization schema exists where any authenticated user could download IOA script and configuration files if the URL is known.

Key dates

02Disclosure timeline

February 25, 2025 CVE published
February 26, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-32435 WordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability CVE-2024-32725 WordPress 5 Stars Rating Funnel plugin 1.2.67 - Broken Access Control vulnerability CVE-2025-68556 WordPress HAPPY plugin <= 1.0.9 - Broken Access Control vulnerability CVE-2025-5304 PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Function CVE-2024-55996 WordPress Payment gateway per Product for WooCommerce plugin <= 3.5.6 - Broken Access Control vulnerability