CVE-2025-12766

An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry® AtHoc® (OnPrem) version 7.21 could allow an attacker to potentially gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS).

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://support.blackberry.com/pkb/s/article/140929	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:blackberry:athoc:7.21:-:*:*:onprem:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de tipo Insecure Direct Object Reference (IDOR) en la Consola de administración de BlackBerry® AtHoc® (OnPrem) versión 7.21 podría permitir a un atacante obtener potencialmente conocimiento no autorizado sobre otras organizaciones alojadas en el mismo Sistema de Advertencia Interactivo (IWS).

Information

Published : 2025-11-19 17:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-12766

Mitre link : CVE-2025-12766

CVE.ORG link : CVE-2025-12766

JSON object : View

Products Affected

blackberry

athoc

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-12766", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12766", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T16:34:07.471199Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secure@blackberry.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.1}]}, "affected": [{"source": "secure@blackberry.com", "affectedData": [{"vendor": "BlackBerry", "modules": ["BlackBerry AtHoc Management Console"], "product": "BlackBerry\u00ae AtHoc\u00ae (OnPrem)", "versions": [{"status": "affected", "version": "7.21"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2025-11-19T17:15:46.690", "references": [{"url": "https://support.blackberry.com/pkb/s/article/140929", "tags": ["Vendor Advisory"], "source": "secure@blackberry.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secure@blackberry.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "An Insecure Direct Object Reference (IDOR) vulnerability in the Management Console of BlackBerry\u00ae AtHoc\u00ae (OnPrem) version 7.21 could allow an attacker to potentially gain unauthorized knowledge about other organizations hosted on the same Interactive Warning System (IWS)."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Insecure Direct Object Reference (IDOR) en la Consola de administraci\u00f3n de BlackBerry\u00ae AtHoc\u00ae (OnPrem) versi\u00f3n 7.21 podr\u00eda permitir a un atacante obtener potencialmente conocimiento no autorizado sobre otras organizaciones alojadas en el mismo Sistema de Advertencia Interactivo (IWS)."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blackberry:athoc:7.21:-:*:*:onprem:*:*:*", "vulnerable": true, "matchCriteriaId": "DA68FFD4-1F31-450D-9405-B136FE4F066B"}], "operator": "OR"}]}], "sourceIdentifier": "secure@blackberry.com"}