CVE-2025-34293
GN4 Publishing System Insecure Direct Object Reference (IDOR) Information Disclosure
- State
- Published
- Severity
- 8.6 High
- Published
- Oct 24, 2025
- Updated
- May 14, 2026
- Reserved
- Apr 15, 2025
Description
GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's object endpoints allow an authenticated user to request arbitrary user IDs and receive sensitive account data for those users, including the stored password and the account's security question and answer. The exposed recovery data and encrypted password may be used to reset or take over the target account.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
GN4 Publishing SystemNaviga Global / Miles 33 |
|
References
- https://www.miles33.com/news/news/5955/naviga--miles-33--acquisition.htmlmedia-coveragerelated
- https://nne.navigacloud.com/GN4Help/gn4_introduction_to_gn4.htmproduct
- https://www.miles33.com/section/14/gn4product
- https://www.vulncheck.com/advisories/gn4-publishing-system-idor-information-disclosurethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.