Vulnerability · Published Oct 23, 2025 · Assigned by GitHub_M

CVE-2025-62169OctoPrint-SpoolManager Plugin APIs do not enforce authentication

High 8.1

In plain English

A high-severity improper authentication in OctoPrint-SpoolManager from WildRikku. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 60.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks. This issue has been patched in versions 1.8.0a3 of the testing branch and 1.7.8 of the stable branch. The impact of this vulnerability is greatly reduced when using OctoPrint version 1.11.2 and newer.

Affected products (as reported)

Vendor	Product	Versions
WildRikku	OctoPrint-SpoolManager	< 1.8.0a3< 1.7.8

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/WildRikku/OctoPrint-SpoolManager/security/advisories/GHSA-2rrc-f24f-94f6 x_refsource_CONFIRM
https://github.com/WildRikku/OctoPrint-SpoolManager/commit/b725e113316e177ce81238a2dbbbdb63d92c40b0 x_refsource_MISC
https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.7.8 x_refsource_MISC
https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.8.0a3 x_refsource_MISC