CVEvulnerability

CVE-2025-66911

6.5 MEDIUM Published 2025-12-19 Modified 2026-10-13 Official page ↗
Status
Analyzed
Published
2025-12-19
Last modified
2026-10-13
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-284, CWE-639

Description

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.

Affected configurations

• turms-im turms 0.10.0-snapshot

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References