CVE-2025-4374 MEDIUM

CVE-2025-4374: Quay: incorrect privilege assignment

Vendor Project Quay
Product quay
Weakness CWE-266
Published May 6, 2025
Last update February 27, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.

Key dates

02Disclosure timeline

May 6, 2025 CVE published
February 27, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-21743 WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerability CVE-2024-27275 IBM i privilege escalation CVE-2025-49388 WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerability CVE-2024-50481 WordPress Bstone Demo Importer plugin <= 1.0.1 - Privilege Escalation vulnerability CVE-2024-22145 WordPress InstaWP Connect plugin <= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerability