Back to Database
Status published
High
CVE-2025-26378
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less...
Vulnerability Description
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated (low-privileged) attacker to reset passwords, including the ones of administrator accounts, via crafted HTTP requests.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-26378
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Diego Giubertoni of Nozomi Networks found this bug during a security research activity.
- Q-Free
More from Q-Free
View All →CVE-2025-26377
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less...
High
8.1
CVE-2025-26376
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less...
Medium
6.5
CVE-2025-26375
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua in Q-Free MaxTime less...
High
8.8
CVE-2025-26374
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (users endpoint) in Q-Free...
Medium
6.5
CVE-2025-26373
A CWE-862 "Missing Authorization" in maxprofile/users/routes.lua (user endpoint) in Q-Free...
Medium
6.5
Affected Vendor
Q-Free
View all reports →Affected Software
MaxTime
Vulnerable Versions:
0
Timeline
Official Publish:
February 12th, 2025
Last Modified:
February 17th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H