PT-2025-48162 · Opto 22 · Groov View

Published 2025-11-26 · Updated 2025-12-01 · CVE-2025-13084

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions groov View (affected versions not specified)

Description The users endpoint within the groov View API reveals a list of all users along with their associated metadata, including API keys. Access to this endpoint is governed by role-based access control, specifically requiring an Editor role. However, even with the necessary role, the endpoint exposes API keys for all users, encompassing those with Administrator privileges. The API endpoint is /users. The exposed data includes API keys associated with each user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1230

Related Identifiers

CVE-2025-13084

Affected Products

Groov View

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-13084 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-329-04.json · Note
• https://t.me/CVEtracker/38300 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-329-04 · Note
• https://twitter.com/CVEnew/status/1993739362748768353 · Twitter Post
• https://twitter.com/cracbot/status/1995447855117635802 · Twitter Post
• https://opto22.com/support/resources-tools/knowledgebase/kb91325 · Note