PT-2025-44369 · Unknown+2 · Connections+2

Maciej Kawka · Published 2025-10-29 · Updated 2025-11-06 · CVE-2025-62503

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-62503

Description A user possessing CREATE privilege but lacking UPDATE privilege for Pools, Connections, and Variables can modify existing records through the bulk create API utilizing the overwrite action. This allows unauthorized modification of data despite insufficient permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-250

Related Identifiers

BIT-AIRFLOW-2025-62503

CVE-2025-62503

GHSA-GP5F-CX7H-8Q6F

Affected Products

Connections

Pools

Variables

References · 11

• https://lists.apache.org/thread/3v58249qscyn1hg240gh8hqg9pb4okcr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62503 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62503 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2025-62503 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gp5f-cx7h-8q6f · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://lists.apache.org/thread/ov923dyccwbv01v9mhcv7t7ykzobycfo · Note
• https://twitter.com/CVEnew/status/1983825531742384576 · Twitter Post
• http://openwall.com/lists/oss-security/2025/10/29/8 · Note
• https://t.me/CVEtracker/36176 · Telegram Post
• https://twitter.com/oss_security/status/1983633338259927154 · Twitter Post