CVE-2025-11690

HighCVSS 8.5/10Last modified Oct 18, 2026

Description

An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix.

Metrics

CVSS 3.1 8.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Nov 4, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-116917.5The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PPOM_Meta::get_fields_CVE-2025-116925.3The Zip Attachments plugin for WordPress is vulnerable to unauthorized loss of data due to a missing authorization and capability checks on CVE-2025-116939.8The Export WP Page to Static HTML & PDF plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inclCVE-2025-116948.7A security issue exists within 1769 CompactLogix controllers due to the missing validation of sequence numbers and source IP addresses in thCVE-2025-116957.5When tlsInsecure=False appears in a connection string, certificate validation is disabled. This vulnerability affects MongoDB Rust Driver vCVE-2025-116968.9A local server-side request forgery (SSRF) security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability aCVE-2025-116978.9A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows usCVE-2025-116989.2A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially CVE-2025-116997.1nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attackCVE-2025-11705.4A vulnerability classified as problematic has been found in code-projects Real Estate Property Management System 1.0. Affected is an unknownCVE-2025-117007.5N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosureCVE-2025-117015.3The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing p