CVE-2025-40676 — Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC

CVE-2025-40676

Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC PUBLISHED

Description (CNA)

Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This vulnerability allows an attacker to access or modify unauthorised resources by manipulating requests that use the 'userID' parameter in '/api/v3/users/<userID>', which may result in the exposure or alteration of sensitive data

Affected (CNA)

Vendor / product	Versions
BBMRI-ERIC / Negotiator	affected 0 before 3.15.5

CWE

CWE-639

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bbmri-eric-negotiator

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.