CVE-2025-62180

Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs.

CVSS

No CVSS.

References

Link	Resource
https://support.pega.com/support-doc/pega-security-advisory-h26-vulnerability-remediation-note
https://support.pega.com/support-doc/pega-security-advisory-i25-vulnerability-remediation-note

Configurations

No configuration.

History

30 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Versiones de Pega Platform 8.3.0 hasta Infinity 25.1.2 se ven afectadas por una debilidad de autorización que puede permitir a usuarios autenticados acceder a ciertos datos adicionales a través de URLs manipuladas.

Information

Published : 2026-06-23 16:16

Updated : 2026-10-06 22:10

NVD link : CVE-2025-62180

Mitre link : CVE-2025-62180

CVE.ORG link : CVE-2025-62180

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-62180", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62180", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T16:31:00.662432Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@pega.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@pega.com", "affectedData": [{"vendor": "Pegasystems", "product": "Pega Infinity", "versions": [{"status": "affected", "version": "8.3.0", "lessThan": "Infinity 25.1.3", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-23T16:16:58.660", "references": [{"url": "https://support.pega.com/support-doc/pega-security-advisory-h26-vulnerability-remediation-note", "source": "security@pega.com"}, {"url": "https://support.pega.com/support-doc/pega-security-advisory-i25-vulnerability-remediation-note", "source": "security@pega.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security@pega.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted URLs."}, {"lang": "es", "value": "Versiones de Pega Platform 8.3.0 hasta Infinity 25.1.2 se ven afectadas por una debilidad de autorizaci\u00f3n que puede permitir a usuarios autenticados acceder a ciertos datos adicionales a trav\u00e9s de URLs manipuladas."}], "lastModified": "2026-10-06T22:10:00.247", "sourceIdentifier": "security@pega.com"}