Skip to content
CVE PROGRAM SOURCE RECORD8.1 High

CVE-2025-26368

A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to r

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Nozomi

Description

A CWE-862 "Missing Authorization" in maxprofile/user-groups/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to remove user groups via crafted HTTP requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Q-Free MaxTime

Default version status: unaffected

  • 0 to ≤ 2.11.0affected

References