CVE-2025-58137

HighCVSS 8.1/10Last modified Oct 7, 2026

Description

Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract.

This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1.

Users are encouraged to upgrade to version 1.13.0, the latest release.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
Apache Software FoundationApache Fineract<= 1.11.0

References

Timeline

Published
Dec 12, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-58145.3The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilityCVE-2025-581429.8[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-581439.8[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-581447.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-581457.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-581469.4There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanCVE-2025-581477.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some ViridCVE-2025-581487.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some ViridCVE-2025-581497.5When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. CVE-2025-58155.3The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maCVE-2025-581508.8Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to withCVE-2025-581519.4varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involv
CVE-2025-58137: High severity, CVSS 8.1 | Vulnix