{"id":"CVE-2025-8789","state":"PUBLISHED","title":"Portabilis i-Educar API Endpoint Diario authorization","description":"A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been classified as problematic. This affects an unknown part of the file /module/Api/Diario of the component API Endpoint. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","publishedAt":"2025-08-10T02:02:05.666Z","updatedAt":"2025-08-13T14:21:57.708Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["Portabilis i-Educar"],"affected":[{"vendor":"Portabilis","product":"i-Educar","versions":[{"version":"2.0","status":"affected"},{"version":"2.1","status":"affected"},{"version":"2.2","status":"affected"},{"version":"2.3","status":"affected"},{"version":"2.4","status":"affected"},{"version":"2.5","status":"affected"},{"version":"2.6","status":"affected"},{"version":"2.7","status":"affected"},{"version":"2.8","status":"affected"},{"version":"2.9.0","status":"affected"}],"modules":["API Endpoint"]}],"references":["https://vuldb.com/?id.319317","https://vuldb.com/?ctiid.319317","https://vuldb.com/?submit.625917","https://github.com/CVE-Hunters/CVE/blob/main/i-educar/CVE-2025-8789.md"],"weaknesses":["CWE-639","CWE-285"],"ingestedAt":"2026-10-29T20:10:04.440Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/8xxx/CVE-2025-8789.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-8789","state":"PUBLISHED","datePublished":"2025-08-10T02:02:05.666Z","dateUpdated":"2025-08-13T14:21:57.708Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2025-08-09T05:11:28.794Z"},"containers":{"cna":{"title":"Portabilis i-Educar API Endpoint Diario authorization","descriptions":[{"lang":"en","value":"A vulnerability was found in Portabilis i-Educar up to 2.9.0. It has been classified as problematic. This affects an unknown part of the file /module/Api/Diario of the component API Endpoint. The manipulation leads to authorization bypass. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."},{"lang":"de","value":"Es wurde eine Schwachstelle in Portabilis i-Educar bis 2.9.0 ausgemacht. Sie wurde als problematisch eingestuft. Es geht dabei um eine nicht klar definierte Funktion der Datei /module/Api/Diario der Komponente API Endpoint. Durch das Beeinflussen mit unbekannten Daten kann eine authorization bypass-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk passieren. Der Exploit steht zur öffentlichen Verfügung."}],"affected":[{"vendor":"Portabilis","product":"i-Educar","versions":[{"version":"2.0","status":"affected"},{"version":"2.1","status":"affected"},{"version":"2.2","status":"affected"},{"version":"2.3","status":"affected"},{"version":"2.4","status":"affected"},{"version":"2.5","status":"affected"},{"version":"2.6","status":"affected"},{"version":"2.7","status":"affected"},{"version":"2.8","status":"affected"},{"version":"2.9.0","status":"affected"}],"modules":["API Endpoint"]}],"references":[{"url":"https://vuldb.com/?id.319317","name":"VDB-319317 | Portabilis i-Educar API Endpoint Diario authorization","tags":["vdb-entry"]},{"url":"https://vuldb.com/?ctiid.319317","name":"VDB-319317 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/?submit.625917","name":"Submit #625917 | Portabilis i-Educar 2.10.0 Authorization Bypass","tags":["third-party-advisory"]},{"url":"https://github.com/CVE-Hunters/CVE/blob/main/i-educar/CVE-2025-8789.md","tags":["exploit"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-639","type":"CWE","lang":"en","description":"Authorization Bypass"}]},{"descriptions":[{"cweId":"CWE-285","type":"CWE","lang":"en","description":"Improper Authorization"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2025-08-10T02:02:05.666Z"},"timeline":[{"time":"2025-08-09T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2025-08-09T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2025-08-09T18:45:38.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"Natan Morette (CVE-Hunters)","type":"finder"},{"lang":"en","value":"nmmorette (VulDB User)","type":"reporter"},{"lang":"en","value":"nmmorette (VulDB User)","type":"analyst"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/CVE-Hunters/CVE/blob/main/i-educar/CVE-2025-8789.md","tags":["exploit"]},{"url":"https://vuldb.com/?submit.625917","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-13T14:21:54.503952Z","id":"CVE-2025-8789","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-13T14:21:57.708Z"}}]}}}