CVE-2025-59111
Broken Access Control in Windu CMS
- State
- Published
- Severity
- 6.9 Medium
- Published
- Nov 18, 2025
- Updated
- Dec 5, 2025
- Reserved
- Sep 9, 2025
Description
Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI.
Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | CERT-PL |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
Windu CMSJCD |
|
References
- https://windu.org/product
- https://cert.pl/posts/2025/11/CVE-2025-59110third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.