CVE-2025-64753

Katalog CVE

CVSS 6.5 · Medium EPSS 0,22%

Kerentanan Incorrect Authorization pada getgrist grist-core. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or tables to which the user was not supposed to have read access. This was fixed in version 1.7.7 by restricting the `/compare` endpoint to users with full read access. As a workaround, remove sensitive document history using the `/states/remove` endpoint. Another possibility is to block the `/compare` endpoint.

Rincian

Terbit di NVD

13 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,22% peluang dieksploitasi; lebih tinggi dari 12,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gristlabs/grist-core/security/advisories/GHSA-3v78-cw58-v685 advisory vendor
• https://github.com/gristlabs/grist-core/releases/tag/v1.7.7 release notes