CVE-2025-3871 — Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier

CVE-2025-3871

Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlier PUBLISHED

Description (CNA)

Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.

Affected (CNA)

Vendor / product	Versions
Fortra / GoAnywhere MFT	affected 0 before 7.8.1

CWE

CWE-862

References

https://www.fortra.com/security/advisories/product-security/FI-2025-009

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.