CVE-2025-66911

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-66911

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66911.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-66911

Published

2025-12-19T15:15:56.900Z

Modified

2026-03-14T12:45:54.785442Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.

References

Affected packages

Git / github.com/turms-im/turms

Affected ranges

Type

GIT

Repo

https://github.com/turms-im/turms

Events

Introduced

Last affected

8e1df48d4b713f7a8c945cbc4dd76e0ecad5c396

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.10.0-snapshot"
        }
    ]
}

Affected versions

v0.*

v0.10.0-SNAPSHOT

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66911.json"