Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2025-62292

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields inten

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SonarSource SonarQube

Default version status: unaffected

  • 10.2 Community to < 25.6 Communityaffected
  • 10.2 Commercial to < 2025.3 Commercialaffected
  • 2025.1 LTA to < 2025.1.3 LTAaffected

References