CVE-2025-21611

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions regardless of their permissions. Notably, the WriteUsers right is unaffected so users may not use this bug to permanently elevate their account permissions. The fix is release in tgstation-server-v6.12.3.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

VendorProductVersions
tgstationtgstation-server>= 6.11.0, < 6.12.3

References

Timeline

Published
Jan 6, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-216128.6TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-suppliCVE-2025-216139.8go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git veCVE-2025-216147.5go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-giCVE-2025-216155.5AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower thanCVE-2025-216165.4Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0CVE-2025-216176.3Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptoCVE-2025-216187.5NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, incluCVE-2025-216199.8GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration foCVE-2025-21624.8The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege usCVE-2025-216207.5Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to oneCVE-2025-216216.1GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scriCVE-2025-216229.1ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change th