PT-2025-49145 · Unknown · Kalmia Cms

Published 2025-12-04 · Updated 2025-12-05 · CVE-2025-65900

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kalmia CMS version 0.2.0

Description Kalmia CMS version 0.2.0 has an issue with access control in the /kal-api/auth/users API endpoint. Insufficient permission validation and excessive data exposure in the backend allow an authenticated user with basic read permissions to retrieve sensitive information for all platform users. The vulnerable parameter is not specified.

Recommendations Apply a fix to address insufficient permission validation and excessive data exposure in the backend of the /kal-api/auth/users API endpoint.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-65900

Affected Products

Kalmia Cms

References · 6

• 🔥 https://github.com/Noxurge/CVE-2025-65900/blob/main/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65900 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65900 · Vendor Advisory
• https://github.com/DifuseHQ/Kalmia · Note
• https://t.me/CVEtracker/38873 · Telegram Post
• https://twitter.com/CVEnew/status/1996698862321324184 · Twitter Post