CVE-2025-6942 LOW

CVE-2025-6942

Vendor Delinea
Product Secret Server
Weakness CWE-639 · IDOR
Published July 2, 2025
Last update July 2, 2025
View on NVD All CVEs

CVSS base score

3.8/10
Attack vector Local
Attack complexity High
Privileges required High
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine.

Key dates

02Disclosure timeline

July 2, 2025 CVE published
July 2, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-49765 WordPress Rate my Post – WP Rating System Plugin <= 3.4.1 is vulnerable to Insecure Direct Object References (IDOR) CVE-2026-22409 WordPress Justicia theme <= 1.2 - Insecure Direct Object References (IDOR) vulnerability CVE-2025-3610 Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update CVE-2018-25270 ThinkPHP 5.0.23 Remote Code Execution via invokefunction CVE-2025-41091 Insecure Direct Object Reference in GPS BOLD Workplanner