CVE-2025-12766 MEDIUM

CVE-2025-12766: Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of affected versions of BlackBerry AtHoc.

Vendor Blackberry
Product BlackBerry® AtHoc® (OnPrem)
Weakness CWE-639 · IDOR
Published November 19, 2025
Last update November 19, 2025
View on NVD All CVEs

CVSS base score

5.0/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry® AtHoc® (OnPrem) version 7.21 could allow an attacker to potentially gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS).

Key dates

02Disclosure timeline

November 19, 2025 CVE published
November 19, 2025 Record updated