CVE-2025-32408 LOW

CVE-2025-32408

Vendor Soffid

Product IAM

Weakness CWE-863 · Incorrect authorization

Published April 21, 2025

Last update April 23, 2025

View on NVD All CVEs

CVSS base score

2.5/10

Attack vector Local

Attack complexity High

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

In Soffid Console 3.6.31 before 3.6.32, authorization to use the pam service is mishandled.

Key dates

02Disclosure timeline

April 21, 2025 CVE published

April 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-32408 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/863.html

Related vulnerabilities

04Related CVE

CVE-2026-44573 Next.js: Middleware / Proxy bypass in Pages Router applications using i18n CVE-2026-1471 Caching of authentication context CVE-2025-66581 Frappe LMS is Missing Server-Side Authorization in Business Logic CVE-2026-34453 SiYuan: Broken access control in /api/bookmark/getBookmark allows unauthenticated publish visitors to read password-protected bookmarked content CVE-2023-28635 Defining resource name as integer in vantage6 may give unintended access