PT-2025-26940 · Unknown · Iroha Board

Yuji Tounai · Published 2025-06-26 · Updated 2025-09-30 · CVE-2025-41404

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: iroha Board versions 0.10.12 and earlier

Description: The issue is related to a direct request problem, also known as forced browsing or navegación forzada, which could allow an attacker who has logged in to the affected product to access non-public content.

Recommendations: For versions 0.10.12 and earlier, consider restricting access to sensitive content until a fix is available. As a temporary workaround, limit user permissions to minimize the risk of exploitation. Avoid using the affected product for sensitive information storage until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2025-41404

Affected Products

Iroha Board

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-41404 · Security Note
• https://irohaboard.irohasoft.jp/security · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-41404 · Vendor Advisory
• https://jvn.jp/en/jp/JVN92520966 · Note
• https://t.me/cveNotify/137010 · Telegram Post
• https://t.me/cvetracker/27102 · Telegram Post
• https://twitter.com/CVEnew/status/1938128343443886273 · Twitter Post