CVE-2025-43712

CVE-2025-43712 is a low-severity vulnerability with a CVSS 3.x base score of 2.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-451.

Key facts

Description

JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier because there is no privilege escalation in the context of the JHipster backend (the report only demonstrates that, after using JHipster to generate an application, one can make a non-functional admin screen visible in the front end of that application).

Frequently asked questions

What is CVE-2025-43712?
JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier because there is no privilege escalation in the context of the JHipster backend (the report only demonstrates that, after using JHipster to generate an application, one can make a non-functional admin screen visible in the front end of that application).
How severe is CVE-2025-43712?
CVE-2025-43712 has a CVSS 3.x base score of 2.9, rated low severity. It is exploitable over local access with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2025-43712 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2025-43712?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-43712 have an EU (EUVD) identifier?
Yes. CVE-2025-43712 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-22595.
When was CVE-2025-43712 published?
CVE-2025-43712 was published on 2025-07-25 and last updated on 2026-06-17.

References

Other CWE-451 vulnerabilities

Browse all CWE-451 vulnerabilities →