CVE-2025-66911

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-66911

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66911.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-66911

Published

2025-12-19T00:00:00Z

Modified

2026-07-15T01:48:55.354916343Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66911.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / github.com/turms-im/turms

Affected ranges

Type

GIT

Repo

https://github.com/turms-im/turms

Events

Introduced

8e1df48d4b713f7a8c945cbc4dd76e0ecad5c396

Last affected

8e1df48d4b713f7a8c945cbc4dd76e0ecad5c396

Database specific

{
    "cpe": "cpe:2.3:a:turms-im:turms:0.10.0-snapshot:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.10.0-snapshot"
        },
        {
            "last_affected": "0.10.0-snapshot"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

0.*

0.10.0-snapshot

v0.*

v0.10.0-SNAPSHOT

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66911.json"