CVE-2025-61876

—

CVSS 3.1

5.0 medium

EPSS

<1%p10

Published

Oct 29, 2025 (Oct 29, 2025)

Modified

Jun 17, 2026

Description

Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an authenticated user with low privileges to enumerate and access tenant information belonging to other clients via modification of the tenant ID in the request URL.

Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.