Vulnerability · Published Oct 28, 2025 · Assigned by INCIBE
CVE-2025-41090Improper Access Control in CCN-CERT microCLAUDIA
High 7.6
In plain English
A high-severity missing authentication in microCLAUDIA from CCN-CERT. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
microCLAUDIA in v3.2.0 and prior has an improper access control vulnerability. This flaw allows an authenticated user to perform unauthorized actions on other organizations' systems by sending direct API requests. To do so, the attacker can use organization identifiers obtained through a compromised endpoint or deduced manually. This vulnerability allows access between tenants, enabling an attacker to list and manage remote assets, uninstall agents, and even delete vaccines configurations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CCN-CERT | microCLAUDIA | 3.2.0 |
Weakness: CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N