VULNERABILITY INTELLIGENCE

CVE-2025-52289

CVSS score8 HIGH

EPSS probability0.44%

CISA KEVNot currently listed

Published2025-07-31

Last modified2026-06-17

Description

A Broken Access Control vulnerability in MagnusBilling v7.8.5.3 allows newly registered users to gain escalated privileges by sending a crafted request to /mbilling/index.php/user/save to set their account status fom "pending" to "active" without requiring administrator approval.