PT-2026-36909 · Ikus · Rdiffweb

Published 2026-05-04 · Updated 2026-05-05 · CVE-2025-67796

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IKUS Rdiffweb versions prior to 2.10.6

Description An improper authorization flaw exists where the API fails to enforce binding between the authenticated subject and the targeted user or tenant. This allows an attacker possessing any valid or stolen access token to impersonate other users, potentially enabling cross-tenant access to read or modify data and perform privileged actions.

Recommendations Update to version 2.10.6.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-67796

GHSA-V4GP-HF5J-4566

Affected Products

Rdiffweb

References · 9

• https://osv.dev/vulnerability/GHSA-v4gp-hf5j-4566 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67796 · Security Note
• https://gitlab.com/ikus-soft/rdiffweb · Note
• https://twitter.com/CVEnew/status/2051383985515663454 · Twitter Post
• https://gitlab.com/ikus-soft/rdiffweb#2106-2025-10-02 · Note
• https://reddit.com/r/CVEWatch/comments/1t4b01f/top_10_trending_cves_05052026 · Reddit Post
• https://twitter.com/infoflowcloud/status/2051385495951732747 · Twitter Post
• https://t.me/CVEtracker/52666 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2051508609427669085 · Twitter Post