AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2025-41090

UNKNOWN · CVSS N/A EPSS 0.32%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2025-10-28 · Last synced 2026-08-04

CyberRota Analysis

This vulnerability has an unknown severity rating. It may be remotely exploitable. Exploitation may require the attacker to be authenticated.

CVE
CVE-2025-41090
Severity
UNKNOWN
CVSS
N/A
EPSS
0.32%

Original NVD Description

microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a compromised endpoint or deduced manually. This vulnerability allows access between tenants, enabling an attacker to list and manage remote assets, uninstall agents, and even delete vaccines configurations.