PT-2025-46340 · Unknown · Verve Asset Manager

Published 2025-11-11 · Updated 2025-11-12 · CVE-2025-11862

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Verve Asset Manager (affected versions not specified)

Description A security issue exists in Verve Asset Manager that allows unauthorized read-only users to perform actions beyond their intended permissions. Specifically, these users can read, update, and delete user data through the API. The issue involves unauthorized modification of user accounts via the API. The API endpoint allows unauthorized actions on user data. The vulnerable functionality allows manipulation of user accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-11862

Affected Products

Verve Asset Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-11862 · Security Note
• https://t.me/pentestingnews/70819 · Telegram Post
• https://twitter.com/CVEnew/status/1988249428822810978 · Twitter Post
• https://t.me/cveNotify/142410 · Telegram Post
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1759.html · Note
• https://t.me/CVEtracker/37041 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1988278187885765017 · Twitter Post