CVE-2025-26378

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests...

CVE-2025-26378

creationtimestamp| type| source ---|---|--- 2025-02-12 14:48:42+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113991465046191646 2025-02-12 15:09:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lhyhdyrtcl24 2025-02-12 15:37:02+00:00| seen|...

CVE-2025-26378

A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated low-privileged attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests...

CVE-2025-26378

CVE-2025-26378 describes a CWE-862 Missing Authorization in Q-Free MaxTime