CVE-2025-40897

HighCVSS 8.1/10Last modified Oct 14, 2026

Description

An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only privileges. An authenticated user with view-only privileges for the Threat Intelligence functionality can perform administrative actions on it, altering the rules configuration, and/or affecting their availability.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Apr 15, 2026
Last modified: Oct 14, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-408988.1A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file.CVE-2025-408998.9A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input para CVE-2025-40905.3A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability CVE-2025-409004.6An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An CVE-2025-409014.8A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input paramet CVE-2025-409024.8A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authent CVE-2025-409034.8A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input pa CVE-2025-409045.4A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An CVE-2025-409057.3WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for CVE-2025-409069.8BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14 CVE-2025-409075.3FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library. The included FastCGI libra CVE-2025-409089.1YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified