PT-2025-52448 · Unknown · Turms Im Server

Xzzz111 · Published 2025-12-19 · Updated 2026-01-02 · CVE-2025-66911

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Turms IM Server versions prior to 0.10.0-SNAPSHOT

Description The software contains a flaw in access control related to querying user online status. An authenticated user can access online status, device information, and login timestamps of any user without authorization. The handleQueryUserOnlineStatusesRequest() method within the UserServiceController.java file is affected.

Recommendations Update to a version newer than 0.10.0-SNAPSHOT.

Exploit

Fix

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

CVE-2025-66911

Affected Products

Turms Im Server

References · 7

• 🔥 https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66911 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66911 · Vendor Advisory
• https://github.com/turms-im/turms · Note
• https://github.com/turms-im/turms/blob/develop/turms-service/src/main/java/im/turms/service/domain/user/access/servicerequest/controller/UserServiceController.java#L239 · Note
• https://t.me/cveNotify/147601 · Telegram Post
• https://twitter.com/CVEnew/status/2002099212985774311 · Twitter Post