VulnerabilityAnalyzed
CVE-2025-66911
Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality.
MEDIUM 6.5EPSS 0.33%
Does this matter?
Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.
Description
Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.33% probability · 25th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284, CWE-639
- Affected
- turms-im/turms
- Source
- cve@mitre.org
References
- https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.mdExploit, Third Party Advisory
- https://github.com/turms-im/turmsProduct
- https://github.com/turms-im/turms/blob/develop/turms-service/src/main/java/im/turms/service/domain/user/access/servicerequest/controller/UserServiceController.java#L239Product
- https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.mdExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.