Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2025-1007

Improper Authorization in /user/namespace/{namespace}/details

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation OpenVSX

Default version status: unaffected

  • 0.9.0 to ≤ 0.20.0affected
  • 0.19.1unaffected

References