CVE-2025-34220

Vasion Print (formerly PrinterLogic) Unauthenticated API Leaks Group Information

State: Published
Severity: 6.9 Medium
Published: Sep 29, 2025
Updated: May 15, 2026
Reserved: Apr 15, 2025

Description

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413 (VA/SaaS deployments) contains a /api-gateway/identity/search-groups endpoint that does not require authentication. Requests to https://<tenant>.printercloud10.com/api-gateway/identity/search-groups and adjustments to the `Host` header allow an unauthenticated remote attacker to enumerate every group object stored for that tenant. The response includes internal identifiers (group ID, source service ID, Azure AD object IDs, creation timestamps, and tenant IDs). This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Print Virtual Appliance HostVasion	before 25.1.102Affected
Print ApplicationVasion	before 25.1.1413Affected

References

https://pierrekim.github.io/blog/2025-04-08-vasion-printerlogic-83-vulnerabilities.html#va-api-leaktechnical-description
https://help.printerlogic.com/va/Print/Security/Security-Bulletins.htmvendor-advisorypatch
https://help.printerlogic.com/saas/Print/Security/Security-Bulletins.htmvendor-advisorypatch
https://www.vulncheck.com/advisories/vasion-print-printerlogic-unauth-api-leaks-group-infothird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.