CVE-2025-62292

State: Published
Severity: 4.3 Medium
Published: Oct 10, 2025
Updated: Oct 10, 2025
Reserved: Oct 10, 2025

Description

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	mitre

Weaknesses

CWE-669 Incorrect Resource Transfer Between Spheres

Affected Products

Product	Versions
SonarQubeSonarSource	10.2 Community to before 25.6 CommunityAffected 10.2 Commercial to before 2025.3 CommercialAffected 2025.1 LTA to before 2025.1.3 LTAAffected

References

https://sonarsource.atlassian.net/browse/SONAR-24830

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.