CVE-2025-57766

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This issue is not directly exploitable on its own and requires a prerequisite vulnerability to obtain valid session tokens in the first place. Version 2.69.1 fixes the issue. No known workarounds are available.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613

Affected software

No affected versions have been published.

Timeline

Published: Sep 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-577677.5Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request i CVE-2025-577686.9Phproject is a high performance full-featured project management system. From 1.8.0 to before 1.8.3, a Stored Cross-Site Scripting (XSS) vul CVE-2025-577696.1FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick CVE-2025-57777.5Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN,CVE-2025-577705.3The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. Versions 4.0.0 to 4.0.CVE-2025-577718.1Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly hand CVE-2025-577729.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, there is a H2 JDBC RCE bypass in Dat CVE-2025-577739.8DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.12, because DB2 parameters are not filte CVE-2025-577747.8There is an out of bounds write vulnerability due to improper bounds checking resulting in invalid data when parsing a DSB file with Digilen CVE-2025-577757.8There is a heap-based Buffer Overflow vulnerability due to improper bounds checking when parsing a DSB file with Digilent DASYLab. This vul CVE-2025-577767.8There is an out of bounds write vulnerability due to improper bounds checking resulting in an invalid address when parsing a DSB file with D CVE-2025-577777.8There is an out of bounds write vulnerability due to improper bounds checking in displ2.dll when parsing a DSB file with Digilent DASYLab.