CVE-2026-25519: openslides

csirt@kutim:~/threat-intel/cve/CVE-2026-25519

CVSS 9.8 · Critical EPSS 0,74%

Kerentanan Improper Access Control pada openslides. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

OpenSlides is a free, web based presentation and assembly system for managing and projecting agenda, motions and elections of an assembly. Prior to version 4.2.29, OpenSlides supports local logins with username and password or an optionally configurable single sign on with SAML via an external IDP. For users synced to OpenSlides via an external IDP, there is an incorrect access control regarding the local login of these users. Users can successfully login using the local login form and the OpenSlides username of a SAML user and a trivial password. This password is valid for all SAML users. This issue has been patched in version 4.2.29.

Rincian

Terbit di NVD: 4 Februari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-284: Improper Access Control
EPSS (30 hari): 0,74% peluang dieksploitasi; lebih tinggi dari 53,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
openslides	openslides	Versi 4.2.5 hingga sebelum 4.2.29

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/OpenSlides/OpenSlides/security/advisories/GHSA-vv4h-8wfc-pf8c patch · advisory vendor
https://github.com/OpenSlides/openslides-auth-service/commit/70c1aa9f5e1db59ec120ecce98d1c1169350a4ee patch
https://github.com/OpenSlides/OpenSlides/releases/tag/4.2.29 product · release notes
https://github.com/OpenSlides/openslides-auth-service/pull/889 issue tracking

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.