CVE-2025-15626

MediumCVSS 5.3/10Last modified Oct 7, 2026

Description

Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application

Metrics

CVSS 4.0 5.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
RibblrCrotchet and Knitting2.5

References

Timeline

Published
Apr 27, 2026
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-156277.5A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust andCVE-2025-156287.5Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed dCVE-2025-156297.5A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllCVE-2025-156305.9A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflowCVE-2025-156315.9A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does noCVE-2025-156323.5A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component CVE-2025-156336.5An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internCVE-2025-156344.3A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmCVE-2025-156354.3Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cross Site Request ForgCVE-2025-156366.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtubCVE-2025-156378.1Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.CVE-2025-1563810.0Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net::Dropbear versions before 0.14 includes versi
CVE-2025-15626: Medium severity, CVSS 5.3 | Vulnix