CVE-2025-62292 - CVE House
Back to Database
Status published Medium CVE-2025-62292

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated...

Vulnerability Description

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62292

Credits & Attribution

No credits recorded in the NVD database.

References

More from SonarSource

View All →
CVE-2025-59844
Argument injection vulnerability in SonarQube Scan Action
High 7.7
CVE-2025-58178
Command Injection via sonarqube-scan-action GitHub Action
High 7.8

Affected Vendor

SonarSource

View all reports →

Affected Software

SonarQube
Vulnerable Versions:
10.2 Community, 10.2 Commercial, 2025.1 LTA

Timeline

Official Publish: October 10th, 2025
Last Modified: October 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-669

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.