Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2025-13432

Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Terraform Enterprise

Default version status: unaffected

  • 1.0.0 to < 1.1.1affected

References