CVE-2025-12100

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-12100

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12100.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-12100

Published

2025-10-23T21:02:18Z

Modified

2026-08-12T03:51:31Z

Severity

8.8 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator

Summary

MongoDB BI Connector ODBC driver installation via MSI may leave ACLs unset on custom installation directories

Details

Incorrect Default Permissions vulnerability in MongoDB BI Connector ODBC driver allows Privilege Escalation.This issue affects BI Connector ODBC driver: from 1.0.0 through 1.4.6.

Database specific

{
    "cna_assigner": "mongodb",
    "cwe_ids": [
        "CWE-276"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12100.json"
}

References

Affected packages

Git / github.com/mongodb/mongo-bi-connector-odbc-driver

Affected ranges

Type

GIT

Repo

https://github.com/mongodb/mongo-bi-connector-odbc-driver

Events

Introduced

f68c45f988f49a9db4b8cc6be90f3e33de1ddd8f

Fixed

2e55ca7850c8571d65a856246bf516dfea1ec123

Fixed

d410bd38dfb761594fc9ea812cdd559760a313b7

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "fixed": "1.4.6"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.3.0

v1.4.0

v1.4.1

v1.4.2

v1.4.3

v1.4.4

v1.4.5

v1.4.6

v1.4.6-beta

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-12100.json"