CVE-2025-59790

CVE-2025-59790: Apache Kvrocks: RESET command grants admin privileges

Vendor Apache Software Foundation

Product Apache Kvrocks

Weakness CWE-269

Published November 28, 2025

Last update November 28, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgrade to version 2.14.0, which fixes the issue.

Key dates

02Disclosure timeline

November 28, 2025 CVE published

November 28, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-59790 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/269.html AskarLabs — CWE-269 write-up Improper Privilege Management

Related vulnerabilities

04Related CVE

CVE-2026-8787 Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation CVE-2026-9842 Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities CVE-2026-2931 Amelia Booking <= 9.1.2 - Authenticated (Customer+) Insecure Direct Object Reference to Arbitrary User Password Change CVE-2026-6897 Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Update via 'wishlistmember_team_accounts_save_settings' AJAX action CVE-2026-6895 Wishlist Member <= 3.30.1 - Missing Authorization to Authenticated (Subscriber+) API Secret Key Disclosure and Privilege Escalation via 'wlm3_export_settings' AJAX Action