CVE-2025-49829

Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations

State: Published
Severity: 6.0 Medium
Published: Jul 15, 2025
Updated: Nov 4, 2025
Reserved: Jun 11, 2025

Description

Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and to bypass permission checks. This issue affects Secrets Manager, Self-Hosted (formerly Conjur Enterprise) prior to versions 13.5.1 and 13.6.1 and Conjur OSS prior to version 1.22.1. Conjur OSS version 1.22.1 and Secrets Manager, Self-Hosted versions 13.5.1 and 13.6.1 fix the issue.

Scores

CVSS	Score	Vector	Source
4.0	6.0 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
conjurcyberark	Conjur OSS < 1.22.1Affected Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) < 13.5.1Affected Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) = 13.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.