CVE-2025-1007 — Improper Authorization in /user/namespace/{namespace}/details

CVE-2025-1007

Improper Authorization in /user/namespace/{namespace}/details PUBLISHED

Description (CNA)

In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.

Affected (CNA)

Vendor / product	Versions
Eclipse Foundation / OpenVSX	affected 0.9.0 through 0.20.0; unaffected 0.19.1

CWE

CWE-285, CWE-283

References

https://github.com/eclipse/openvsx/security/advisories/GHSA-wc7c-xq2f-qp4h

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.