Dashboard / CVE-2025-65900

CVE-2025-65900

MEDIUM 1 PoC
MEDIUM Priority: 0.02 BB Relevance: 73/100
Published: 2025-12-04 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all platform users.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
difuse kalmia 0.2.0

References & Advisories (2)

Proof of Concept (1)

—
https://github.com/Noxurge/CVE-2025-65900
nomi-sec

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction
✓ PoC available (1)

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

0.33%
Raw Score 0.003260
Percentile 25.9%
Date 2026-11-08

EPSS Trend

2026-11-08
0.00326
2026-11-07
0.00326
2026-11-06
0.00326
2026-11-05
0.00326
2026-11-04
0.00326

Intelligence Sources

nvd ref →

External Links