CVE-2025-65900

PoC —

CVSS 3.1

6.5 medium

EPSS

<1%p23

Published

Dec 4, 2025 (Dec 4, 2025)

Modified

Jun 17, 2026

Description

Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all platform users.

Vendors: difuse
Products: kalmia
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.