CVE-2025-66911

Turms IM Server versions v0.10.0-SNAPSHOT and earlier are susceptible to a broken access control vulnerability within the user online status query functionality. The root cause is located in the handleQueryUserOnlineStatusesRequest() method of UserServiceController.java, which fails to perform pr...

CVE-2025-66911

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest method in UserServiceController.java allows any authenticated user to query the online status, device information, an...