PT-2025-48739 · Unknown · Terminalfour

Published 2025-12-02 · Updated 2025-12-19 · CVE-2025-58386

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Terminalfour versions 8 through 8.4.1.1

Description The userLevel parameter within the user management function lacks sufficient server-side authorization checks. A Power User can manipulate this parameter to assign the Administrator role to existing lower-privileged accounts or new accounts, effectively escalating privileges. This manipulation also allows the Power User to change the target account's password, gaining full control. The vulnerable parameter is userLevel.

Recommendations Versions prior to 8.4.1.1 should be updated.

Fix

LPE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-58386

Affected Products

Terminalfour

References · 7

• https://osv.dev/vulnerability/CVE-2025-58386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58386 · Security Note
• https://docs.terminalfour.com/release-notes/security-notices/cve-2025-58386 · Vendor Advisory
• https://t.me/cveNotify/146385 · Telegram Post
• https://terminalfour.com · Note
• https://twitter.com/CVEnew/status/1995930000151744747 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1995965438216261760 · Twitter Post