{"id":"CVE-2025-46296","state":"PUBLISHED","title":"An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features such as viewing licens","description":"An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features such as viewing license details and downloading application logs. This vulnerability has been fully addressed in FileMaker Server 22.0.4.","publishedAt":"2025-12-16T18:07:37.678Z","updatedAt":"2025-12-16T19:25:12.162Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","source":"CISA-ADP"},"assigner":"apple","products":["Claris FileMaker Server"],"affected":[{"vendor":"Claris","product":"FileMaker Server","versions":[{"version":"unspecified","status":"affected","lessThan":"22.0.4","versionType":"custom"}]}],"references":["https://support.claris.com/s/answerview?anum=000049056&language=en_US"],"weaknesses":["CWE-285"],"ingestedAt":"2026-10-29T20:09:17.366Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/46xxx/CVE-2025-46296.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-46296","state":"PUBLISHED","datePublished":"2025-12-16T18:07:37.678Z","dateUpdated":"2025-12-16T19:25:12.162Z","assignerShortName":"apple","assignerOrgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateReserved":"2025-04-22T21:13:49.959Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features such as viewing license details and downloading application logs. This vulnerability has been fully addressed in FileMaker Server 22.0.4."}],"affected":[{"vendor":"Claris","product":"FileMaker Server","versions":[{"version":"unspecified","status":"affected","lessThan":"22.0.4","versionType":"custom"}]}],"references":[{"url":"https://support.claris.com/s/answerview?anum=000049056&language=en_US"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features such as viewing license details and downloading application logs."}]}],"providerMetadata":{"shortName":"apple","orgId":"286789f9-fbc2-4510-9f9a-43facdede74c","dateUpdated":"2025-12-16T18:07:37.678Z"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-12-16T19:21:28.990087Z","id":"CVE-2025-46296","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-285","type":"CWE","lang":"en","description":"CWE-285 Improper Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-16T19:25:12.162Z"}}]}}}