Vulnerability · Published Jan 12, 2026 · Assigned by INCIBE
CVE-2025-41078Multiple vulnerabilities in Viafirma products
High 8.7
In plain English
A high-severity incorrect authorization in Viafirma Documents from Viafirma. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.2%top 85.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Viafirma | Viafirma Documents | v3.7.129 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N