Vulnerability · Published Aug 9, 2025 · Assigned by VulDB

CVE-2025-8756TDuckCloud tduck-platform manage preHandle improper authorization

Medium 6.3

In plain English

A medium-severity security flaw in tduck-platform from TDuckCloud. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 64.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of the file /manage/ of the component com.tduck.cloud.api.web.interceptor.AuthorizationInterceptor. The manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
TDuckCloud	tduck-platform	5.05.1

Weakness: CWE-285, CWE-266 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-319261 | TDuckCloud tduck-platform manage preHandle improper authorization vdb-entry, technical-description
VDB-319261 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #624188 | https://www.tduckcloud.com tduck-platform commit e71c1e5 Improper Access Controls third-party-advisory
https://github.com/TDuckCloud/tduck-platform/issues/28 issue-tracking
https://github.com/TDuckCloud/tduck-platform/issues/28#issue-3269885235 exploit, issue-tracking