CVE-2025-0836

XProtect MIP API Missing Authorization

State: Published
Severity: 5.3 Medium
Published: Dec 16, 2025
Updated: Dec 16, 2025
Reserved: Jan 29, 2025

Description

Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	Milestone
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	Milestone

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
XProtect VMSMilestone Systems	23.1 to before 23.1.157.1.1470Affected 23.2 to before 23.2.21.1.398Affected 23.3 to before 23.3.72.1.466Affected 24.1 to before 24.1.12292.2279Affected 24.2 to before 24.2.14561.2270Affected 25.1 to before 25.1.15990.2272Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.