CVE-2025-14660

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-14660

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14660.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-14660

Published

2025-12-14T12:32:08.752Z

Modified

2026-07-15T01:49:01.795278209Z

Severity

2.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

DecoCMS Mesh Workspace Domain api.ts createTool access control

Details

A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/api.ts of the component Workspace Domain Handler. This manipulation of the argument domain causes improper access controls. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been published and may be used. Upgrading to version 1.0.0-alpha.32 addresses this issue. Patch name: 5f7315e05852faf3a9c177c0a34f9ea9b0371d3d. It is recommended to upgrade the affected component.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.0.0-alpha.0"
                },
                {
                    "last_affected": "1.0.0-alpha.0"
                },
                {
                    "introduced": "1.0.0-alpha.7"
                },
                {
                    "last_affected": "1.0.0-alpha.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14660.json",
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-266",
        "CWE-284"
    ]
}

References

Affected packages

Git / github.com/decocms/studio

Affected ranges

Type

GIT

Repo

https://github.com/decocms/studio

Events

Introduced

30c2901e7d1d1b641d7d24ad909e3f35e451653e

Fixed

5f7315e05852faf3a9c177c0a34f9ea9b0371d3d

Fixed

2ba6478c30c52f640df09098744294380946f4a1

Database specific

{
    "extracted_events": [
        {
            "introduced": "1.0.0-alpha.1"
        },
        {
            "last_affected": "1.0.0-alpha.1"
        },
        {
            "introduced": "1.0.0-alpha.2"
        },
        {
            "last_affected": "1.0.0-alpha.2"
        },
        {
            "introduced": "1.0.0-alpha.3"
        },
        {
            "last_affected": "1.0.0-alpha.3"
        },
        {
            "introduced": "1.0.0-alpha.4"
        },
        {
            "last_affected": "1.0.0-alpha.4"
        },
        {
            "introduced": "1.0.0-alpha.5"
        },
        {
            "last_affected": "1.0.0-alpha.5"
        },
        {
            "introduced": "1.0.0-alpha.6"
        },
        {
            "last_affected": "1.0.0-alpha.6"
        },
        {
            "introduced": "1.0.0-alpha.8"
        },
        {
            "last_affected": "1.0.0-alpha.8"
        },
        {
            "introduced": "1.0.0-alpha.9"
        },
        {
            "last_affected": "1.0.0-alpha.9"
        },
        {
            "introduced": "1.0.0-alpha.10"
        },
        {
            "last_affected": "1.0.0-alpha.10"
        },
        {
            "introduced": "1.0.0-alpha.11"
        },
        {
            "last_affected": "1.0.0-alpha.11"
        },
        {
            "introduced": "1.0.0-alpha.12"
        },
        {
            "last_affected": "1.0.0-alpha.12"
        },
        {
            "introduced": "1.0.0-alpha.13"
        },
        {
            "last_affected": "1.0.0-alpha.13"
        },
        {
            "introduced": "1.0.0-alpha.14"
        },
        {
            "last_affected": "1.0.0-alpha.14"
        },
        {
            "introduced": "1.0.0-alpha.15"
        },
        {
            "last_affected": "1.0.0-alpha.15"
        },
        {
            "introduced": "1.0.0-alpha.16"
        },
        {
            "last_affected": "1.0.0-alpha.16"
        },
        {
            "introduced": "1.0.0-alpha.17"
        },
        {
            "last_affected": "1.0.0-alpha.17"
        },
        {
            "introduced": "1.0.0-alpha.18"
        },
        {
            "last_affected": "1.0.0-alpha.18"
        },
        {
            "introduced": "1.0.0-alpha.19"
        },
        {
            "last_affected": "1.0.0-alpha.19"
        },
        {
            "introduced": "1.0.0-alpha.20"
        },
        {
            "last_affected": "1.0.0-alpha.20"
        },
        {
            "introduced": "1.0.0-alpha.21"
        },
        {
            "last_affected": "1.0.0-alpha.21"
        },
        {
            "introduced": "1.0.0-alpha.22"
        },
        {
            "last_affected": "1.0.0-alpha.22"
        },
        {
            "introduced": "1.0.0-alpha.23"
        },
        {
            "last_affected": "1.0.0-alpha.23"
        },
        {
            "introduced": "1.0.0-alpha.24"
        },
        {
            "last_affected": "1.0.0-alpha.24"
        },
        {
            "introduced": "1.0.0-alpha.25"
        },
        {
            "last_affected": "1.0.0-alpha.25"
        },
        {
            "introduced": "1.0.0-alpha.26"
        },
        {
            "last_affected": "1.0.0-alpha.26"
        },
        {
            "introduced": "1.0.0-alpha.27"
        },
        {
            "last_affected": "1.0.0-alpha.27"
        },
        {
            "introduced": "1.0.0-alpha.28"
        },
        {
            "last_affected": "1.0.0-alpha.28"
        },
        {
            "introduced": "1.0.0-alpha.29"
        },
        {
            "last_affected": "1.0.0-alpha.29"
        },
        {
            "introduced": "1.0.0-alpha.30"
        },
        {
            "last_affected": "1.0.0-alpha.30"
        },
        {
            "introduced": "1.0.0-alpha.31"
        },
        {
            "last_affected": "1.0.0-alpha.31"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0-alpha.1

1.0.0-alpha.10

1.0.0-alpha.11

1.0.0-alpha.12

1.0.0-alpha.13

1.0.0-alpha.14

1.0.0-alpha.15

1.0.0-alpha.16

1.0.0-alpha.17

1.0.0-alpha.18

1.0.0-alpha.19

1.0.0-alpha.2

1.0.0-alpha.20

1.0.0-alpha.21

1.0.0-alpha.22

1.0.0-alpha.23

1.0.0-alpha.24

1.0.0-alpha.25

1.0.0-alpha.26

1.0.0-alpha.27

1.0.0-alpha.28

1.0.0-alpha.29

1.0.0-alpha.3

1.0.0-alpha.30

1.0.0-alpha.4

1.0.0-alpha.5

1.0.0-alpha.6

1.0.0-alpha.8

1.0.0-alpha.9

bindings-v1.*

bindings-v1.0.1-alpha.24

mesh-npm-v1.*

mesh-npm-v1.0.0-alpha.1

mesh-npm-v1.0.0-alpha.12

mesh-npm-v1.0.0-alpha.2

mesh-npm-v1.0.0-alpha.3

mesh-npm-v1.0.0-alpha.4

mesh-npm-v1.0.0-alpha.6

mesh-npm-v1.0.0-alpha.8

mesh-npm-v1.0.0-alpha.9

mesh-v0.*

mesh-v0.2.4

mesh-v0.2.5

runtime-v1.*

runtime-v1.0.0-alpha.40

runtime-v1.0.0-alpha.41

v1.*

v1.0.0-alpha.13

v1.0.0-alpha.14

v1.0.0-alpha.15

v1.0.0-alpha.16

v1.0.0-alpha.17

v1.0.0-alpha.18

v1.0.0-alpha.19

v1.0.0-alpha.20

v1.0.0-alpha.21

v1.0.0-alpha.22

v1.0.0-alpha.23

v1.0.0-alpha.24

v1.0.0-alpha.25

v1.0.0-alpha.26

v1.0.0-alpha.27

v1.0.0-alpha.28

v1.0.0-alpha.29

v1.0.0-alpha.30

v1.0.0-alpha.31

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14660.json"