VulnerabilityDeferred

CVE-2025-30189

When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users.

HIGH 7.4EPSS 0.54%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

When cache is enabled, some passdb/userdb drivers incorrectly cache all users with same cache key, causing wrong cached information to be used for these users. After cached login, all subsequent logins are for same user. Install fixed version or disable caching either globally or for the impacted passdb/userdb drivers. No publicly available exploits are known.

CVSS 3.1: 7.4 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS: 0.54% probability · 44th percentile
CISA KEV: Not listed
Weakness: CWE-1250
Source: security@open-xchange.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.