Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2025-34140

ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

An authorization bypass vulnerability exists in ETQ Reliance (legacy CG and NXG SaaS platforms). By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration in API authorization logic, which has since been corrected in SE.2025.1 and 2025.1.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ETQ Reliance CG (legacy)

Default version status: unaffected

  • 0 to < SE.2025.1affected
  • SE.2025.1unaffected

ETQ Reliance NXG (SaaS)

Default version status: unaffected

  • 0 to < 2025.1.2affected
  • 2025.1.2unaffected

References