PT-2025-44030 · Unknown · Turbotenant

Published 2025-10-27 · Updated 2025-10-28 · CVE-2025-62516

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TurboTenant versions prior to 2.0.0

Description A security issue exists in the TurboTenant landlord onboarding and rental signup system, specifically within the property listing activation workflow. This issue could allow unauthorized access to Stripe payment session data, potentially exposing sensitive business metadata, including landlord dashboard sync details and tenant information. The affected functionality involves API endpoints responsible for property listing activation, subscription metadata, and payment link generation.

Recommendations Update to a version newer than 2.0.0.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-62516

GHSA-43CM-Q3MV-2HVJ

Affected Products

Turbotenant

References · 6

• https://osv.dev/vulnerability/CVE-2025-62516 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62516 · Security Note
• https://github.com/turbo-tenant-internal-property/www.turbotenant.com/security/advisories/GHSA-43cm-q3mv-2hvj · Note
• https://t.me/CVEtracker/35894 · Telegram Post
• https://twitter.com/CveTodo/status/1983052420922908801 · Twitter Post
• https://twitter.com/offseq/status/1983005923510542808 · Twitter Post