CVE-2025-2306 — Improper Access Control vulnerability in LIVE CONTRACT

CVE-2025-2306

Improper Access Control vulnerability in LIVE CONTRACT PUBLISHED

Description (CNA)

An Improper Access Control vulnerability was identified in the file download functionality. This vulnerability allows users to download sensitive documents without authentication, if the URL is known. The attack requires the attacker to know the documents UUIDv4.

Affected (CNA)

Vendor / product	Versions
SYNCPILOT / LIVE CONTRACT	affected 3 before 5.4.12; affected 5.5 before 5.5.4; affected 5.6 before 5.6.3

CWE

CWE-284

References

https://www.cirosec.de/sa/sa-2025-004

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.