Vulnerability-Lookup

CVE-2025-55741 (GCVE-0-2025-55741)

Vulnerability from cvelistv5 – Published: 2025-08-22 16:04 – Updated: 2025-08-22 16:24

Title

unopim/unopim allows unauthorized product deletion via mass-delete endpoint

Summary

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist.

Severity ?

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CWE

CWE-284 - Improper Access Control
CWE-862 - Missing Authorization

Assigner

GitHub_M

References

URL

Tags

	https://github.com/unopim/unopim/security/advisor…	x_refsource_CONFIRM
	https://github.com/unopim/unopim/commit/c14eebe65…	x_refsource_MISC
	https://www.youtube.com/watch?v=J_WV8fCXlJM	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	unopim	unopim	Affected: < 0.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55741",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-08-22T16:24:44.604860Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-08-22T16:24:48.523Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://www.youtube.com/watch?v=J_WV8fCXlJM"
          },
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "unopim",
          "vendor": "unopim",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-22T16:04:51.542Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx"
        },
        {
          "name": "https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989"
        },
        {
          "name": "https://www.youtube.com/watch?v=J_WV8fCXlJM",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.youtube.com/watch?v=J_WV8fCXlJM"
        }
      ],
      "source": {
        "advisory": "GHSA-8p2f-fx4q-75cx",
        "discovery": "UNKNOWN"
      },
      "title": "unopim/unopim allows unauthorized product deletion via mass-delete endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-55741",
    "datePublished": "2025-08-22T16:04:51.542Z",
    "dateReserved": "2025-08-14T22:31:17.684Z",
    "dateUpdated": "2025-08-22T16:24:48.523Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-55741\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-08-22T16:24:44.604860Z\"}}}], \"references\": [{\"url\": \"https://www.youtube.com/watch?v=J_WV8fCXlJM\", \"tags\": [\"exploit\"]}, {\"url\": \"https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-08-22T16:24:35.765Z\"}}], \"cna\": {\"title\": \"unopim/unopim allows unauthorized product deletion via mass-delete endpoint\", \"source\": {\"advisory\": \"GHSA-8p2f-fx4q-75cx\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.1, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"unopim\", \"product\": \"unopim\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.3.1\"}]}], \"references\": [{\"url\": \"https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx\", \"name\": \"https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989\", \"name\": \"https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.youtube.com/watch?v=J_WV8fCXlJM\", \"name\": \"https://www.youtube.com/watch?v=J_WV8fCXlJM\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-284\", \"description\": \"CWE-284: Improper Access Control\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-08-22T16:04:51.542Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-55741\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-08-22T16:24:48.523Z\", \"dateReserved\": \"2025-08-14T22:31:17.684Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-08-22T16:04:51.542Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GHSA-8P2F-FX4Q-75CX

Vulnerability from github – Published: 2025-08-22 16:49 – Updated: 2025-08-22 21:08

Summary

UnoPim has Broken Access Control

Details

Summary

In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.

Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption

Affected Behavior

Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.

Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.

PoC

A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.

Impact

Unauthorized product deletion -> data loss, possible business disruption

Severity ?

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.3.0"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "unopim/unopim"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-55741"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-08-22T16:49:55Z",
    "nvd_published_at": "2025-08-22T16:15:46Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nIn Unopim, it is possible to create roles and choose the privileges. However, users without the \u201cDelete\u201d privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.\n\n**Severity**:\u00a0High CVSS Score 8.1 (CVSS 3.1 Vector:\u00a0[AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\u0026version=3.1))\n**Category**: Broken Access Control / Missing Authorization (OWASP A01:2021)\n**Impact**: Unauthorized product deletion -\u003e data loss, possible business disruption\n\n### Affected Behavior\n**Single delete (enforced):**\n**DELETE** `/admin/catalog/products/{id}` returns 401 with \"This action is unauthorized\" for users lacking the Delete privilege.\n\n**Mass delete (not enforced):**\n**POST** `/admin/catalog/products/mass-delete` allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.\n\n### PoC\nA video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.\n\n### Impact\nUnauthorized product deletion -\u003e data loss, possible business disruption",
  "id": "GHSA-8p2f-fx4q-75cx",
  "modified": "2025-08-22T21:08:49Z",
  "published": "2025-08-22T16:49:55Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55741"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unopim/unopim/commit/f49fa630afd36ff61c146b3e5bc7a0808667ca19"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/unopim/unopim"
    },
    {
      "type": "WEB",
      "url": "https://www.youtube.com/watch?v=J_WV8fCXlJM"
    },
    {
      "type": "WEB",
      "url": "https://youtu.be/J_WV8fCXlJM"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "UnoPim has Broken Access Control"
}

FKIE_CVE-2025-55741

Vulnerability from fkie_nvd - Published: 2025-08-22 16:15 - Updated: 2025-08-25 17:36

Severity ?

8.1 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989	Patch
security-advisories@github.com	https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx	Exploit, Vendor Advisory
security-advisories@github.com	https://www.youtube.com/watch?v=J_WV8fCXlJM	Exploit
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.youtube.com/watch?v=J_WV8fCXlJM	Exploit

Impacted products

	Vendor	Product	Version
	webkul	unopim	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:webkul:unopim:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AE1E6BA-5691-4E33-B77B-8548506CEE50",
              "versionEndExcluding": "0.3.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist."
    },
    {
      "lang": "es",
      "value": "UnoPim es un sistema de gesti\u00f3n de informaci\u00f3n de productos (PIM) de c\u00f3digo abierto basado en el framework Laravel. En las versiones 0.3.0 y anteriores, los usuarios sin el privilegio de eliminaci\u00f3n de productos no pueden eliminar productos individuales a trav\u00e9s del endpoint est\u00e1ndar, como se esperaba. Sin embargo, estos usuarios pueden eludir los controles de acceso previstos enviando solicitudes al endpoint de eliminaci\u00f3n masiva, lo que les permite eliminar productos sin la debida autorizaci\u00f3n. Esta vulnerabilidad permite la eliminaci\u00f3n no autorizada de productos, lo que puede provocar la p\u00e9rdida de datos e interrupciones del negocio. El problema se ha corregido en la versi\u00f3n 0.3.1. No existen soluciones alternativas conocidas."
    }
  ],
  "id": "CVE-2025-55741",
  "lastModified": "2025-08-25T17:36:47.337",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-08-22T16:15:46.087",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit"
      ],
      "url": "https://www.youtube.com/watch?v=J_WV8fCXlJM"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit"
      ],
      "url": "https://www.youtube.com/watch?v=J_WV8fCXlJM"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-55741 (GCVE-0-2025-55741)

GHSA-8P2F-FX4Q-75CX

Summary

Affected Behavior

PoC

Impact

FKIE_CVE-2025-55741

Tags

Sightings

Nomenclature