VULNERABILITY INTELLIGENCE

CVE-2025-66911

CVSS score6.5 MEDIUM

EPSS probability0.33%

CISA KEVNot currently listed

Published2025-12-19

Last modified2026-10-13

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.

Weakness classification

CWE-284: Improper Access Control
CWE-639: Authorization Bypass Through User-Controlled Key

Primary references

cve@mitre.org — Exploit, Third Party Advisory
cve@mitre.org — Product
cve@mitre.org — Product
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory