CVE-2025-66911

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.md	Exploit Third Party Advisory
https://github.com/turms-im/turms	Product
https://github.com/turms-im/turms/blob/develop/turms-service/src/main/java/im/turms/service/domain/user/access/servicerequest/controller/UserServiceController.java#L239	Product
https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.md	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:turms-im:turms:0.10.0-snapshot:*:*:*:*:*:*:*

History

05 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Turms IM Servidor v0.10.0-SNAPSHOT y anteriores contiene una vulnerabilidad de control de acceso roto en la funcionalidad de consulta de estado en línea del usuario. El método handleQueryUserOnlineStatusesRequest() en UserServiceController.java permite a cualquier usuario autenticado consultar el estado en línea, la información del dispositivo y las marcas de tiempo de inicio de sesión de usuarios arbitrarios sin las comprobaciones de autorización adecuadas.

Information

Published : 2025-12-19 15:15

Updated : 2026-10-13 11:10

NVD link : CVE-2025-66911

Mitre link : CVE-2025-66911

CVE.ORG link : CVE-2025-66911

JSON object : View

Products Affected

turms-im

turms

CWE

CWE-284

Improper Access Control

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2025-66911", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66911", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-19T15:23:41.926121Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-19T15:15:56.900", "references": [{"url": "https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.md", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/turms-im/turms", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/turms-im/turms/blob/develop/turms-service/src/main/java/im/turms/service/domain/user/access/servicerequest/controller/UserServiceController.java#L239", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.md", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks."}, {"lang": "es", "value": "Turms IM Servidor v0.10.0-SNAPSHOT y anteriores contiene una vulnerabilidad de control de acceso roto en la funcionalidad de consulta de estado en l\u00ednea del usuario. El m\u00e9todo handleQueryUserOnlineStatusesRequest() en UserServiceController.java permite a cualquier usuario autenticado consultar el estado en l\u00ednea, la informaci\u00f3n del dispositivo y las marcas de tiempo de inicio de sesi\u00f3n de usuarios arbitrarios sin las comprobaciones de autorizaci\u00f3n adecuadas."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:turms-im:turms:0.10.0-snapshot:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9466432E-2863-4A5B-913F-E6E64090F60B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}