PT-2025-40986 · Unknown · Negotiator

Published 2025-10-07 · Updated 2025-10-07 · CVE-2025-40676

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Negotiator version 3.15.2

Description An Insecure Direct Object Reference (IDOR) exists in Negotiator. This allows an attacker to access or modify unauthorized resources by manipulating requests. The issue involves the userID parameter within the /api/v3/users/<userID> API endpoint, potentially leading to the exposure or alteration of sensitive data.

Recommendations Apply appropriate access controls to the /api/v3/users/<userID> API endpoint to prevent unauthorized access based on the userID parameter.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-40676

Affected Products

Negotiator

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-40676 · Security Note
• https://t.me/CVEtracker/34308 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bbmri-eric-negotiator · Note
• https://twitter.com/CVEnew/status/1975548416605192327 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1975568018009673767 · Twitter Post