Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2025-26374

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) at

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Nozomi

Description

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to enumerate users via crafted HTTP requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Q-Free MaxTime

Default version status: unaffected

  • 0 to ≤ 2.11.0affected

References