CVE-2025-47411

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-47411
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47411.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-47411
Aliases
Published
2026-01-01T16:41:51.743Z
Modified
2026-07-15T01:48:50.026464987Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Apache StreamPipes: Leverage of User ID for Privilege Escalation
Details

A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. 

This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues.

This issue affects Apache StreamPipes: through 0.97.0.

Users are recommended to upgrade to version 0.98.0, which fixes the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-269"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47411.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "0.69.0"
                },
                {
                    "last_affected": "0.97.0"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "0.97.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ],
    "cna_assigner": "apache"
}
References

Affected packages

Git / github.com/apache/streampipes

Affected ranges

Type
GIT
Repo
https://github.com/apache/streampipes
Events
Introduced
952c51b2d6f76648a349167e97be2b8c30783dc5
Fixed
57fd58a574bcc9113ea23c91f5efdf8913b4c2ba
Database specific 
{
    "cpe": "cpe:2.3:a:apache:streampipes:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.69.0"
        },
        {
            "fixed": "0.98.0"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47411.json"