PT-2025-47784 · Hashicorp · Terraform Enterprise

Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-13432

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Terraform Enterprise versions prior to 1.0.3 and prior to 1.1.1

Description A user with limited permissions within a Terraform Enterprise workspace can create Terraform state versions. This could lead to infrastructure changes if a subsequent plan operation is approved by a user with appropriate permissions or is auto-applied.

Recommendations Update to Terraform Enterprise version 1.0.3 or later. Update to Terraform Enterprise version 1.1.1 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-13432

Affected Products

Terraform Enterprise

References · 5

• https://osv.dev/vulnerability/CVE-2025-13432 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13432 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821 · Vendor Advisory
• https://t.me/CVEtracker/37955 · Telegram Post
• https://twitter.com/CVEnew/status/1991882352084005080 · Twitter Post