CVE-2025-13084

Opto 22 groov View Exposure of Sensitive Information Through Metadata

State: Published
Severity: 6.1 Medium
Published: Nov 26, 2025
Updated: Nov 26, 2025
Reserved: Nov 12, 2025

Description

The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.

Scores

CVSS	Score	Vector	Source
4.0	6.1 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N	icscert
3.1	7.6 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L	icscert

Weaknesses

CWE-1230

Affected Products

Product	Versions
groov View ServerOpto 22	R1.0a through R4.5dAffected
GRV-EPIC-PR1 FirmwareOpto 22	4.0.3 and earlierAffected
GRV-EPIC-PR2 FirmwareOpto 22	4.0.3 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.