PT-2025-30814 · Jhipster · Jhipster

Published 2025-07-25 · Updated 2025-08-04 · CVE-2025-43712

Positive Technologies (AI Summary)

CVSS v3.1

2.9

Low

Base vector

AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions JHipster versions prior to 8.9.0

Description JHipster versions prior to 8.9.0 are susceptible to privilege escalation through manipulation of the authorities parameter. After registering and logging in as a standard user, the authorities parameter within the response from the /api/account endpoint contains the value ROLE USER. By modifying this parameter to ROLE ADMIN, a user can escalate their privileges to an administrative level, gaining access to all admin-related functionalities. However, the validity of this report has been disputed, with some suggesting the issue only affects the front end and does not represent a backend privilege escalation.

Recommendations Update JHipster to version 8.9.0 or later.

Fix

LPE

Improper Access Control

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-284

CWE-451

Related Identifiers

CVE-2025-43712

GHSA-CMM8-GW4M-26CW

Affected Products

Jhipster

References · 13

• https://osv.dev/vulnerability/CVE-2025-43712 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43712 · Security Note
• https://osv.dev/vulnerability/GHSA-cmm8-gw4m-26cw · Vendor Advisory
• https://github.com/jhipster/generator-jhipster/releases · Note
• https://github.com/jhipster/generator-jhipster · Note
• https://twitter.com/VulmonFeeds/status/1948762016287510878 · Twitter Post
• https://medium.com/@hritikgodara/cve-2025-43712-privilege-escalation-via-response-manipulation-in-the-jhipster-platform-5e18c0434def · Note
• https://twitter.com/CVEnew/status/1948733594882511220 · Twitter Post
• https://twitter.com/bluegaspode/status/1949232256612237406 · Twitter Post
• https://groups.google.com/g/jhipster-dev/c/ATSlWkEjw2w · Note
• https://firecompass.com/cve-2025-43712-jhipster-platform-privilege-escalation-vulnerability-discovered-by-firecompass-research-added-to-nist · Note
• https://twitter.com/FireCompass/status/1950911826604027923 · Twitter Post
• https://t.me/cveNotify/130742 · Telegram Post