Vulnerability · Published Nov 21, 2025 · Assigned by HashiCorp
CVE-2025-13432Terraform Enterprise state versions can be created by users with specific permissions without sufficient write access
Medium 4.3
In plain English
A medium-severity incorrect authorization in Terraform Enterprise from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).
Official description
Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Terraform Enterprise | 1.0.0 – before 1.1.1 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N