How severe is CVE-2025-49591?

CVE-2025-49591 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2025-49591 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-49591?

CVE-2025-49591 affects Xwiki Cryptpad. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-49591?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2025-49591 have an EU (EUVD) identifier?

Yes. CVE-2025-49591 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-18909.

When was CVE-2025-49591 published?

CVE-2025-49591 was published on 2025-06-18 and last updated on 2026-06-17.

CVE-2025-49591

CVE-2025-49591 is a critical-severity vulnerability in Xwiki Cryptpad with a CVSS 3.x base score of 9.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-284.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
CVSS v4: 7.4
EPSS exploit prediction: 0% (36th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-18909
Weakness: CWE-284
Affected product: Xwiki Cryptpad
Published: 2025-06-18
Last modified: 2026-06-17

Description

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0.

Frequently asked questions

What is CVE-2025-49591?: CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user's credentials can gain access to the victim's account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0.
How severe is CVE-2025-49591?: CVE-2025-49591 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2025-49591 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (36th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-49591?: CVE-2025-49591 affects Xwiki Cryptpad. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-49591?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2025-49591 have an EU (EUVD) identifier?: Yes. CVE-2025-49591 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-18909.
When was CVE-2025-49591 published?: CVE-2025-49591 was published on 2025-06-18 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:xwiki:cryptpad:*:*:*:*:*:*:*:*

More vulnerabilities in Xwiki Cryptpad

CVE-2025-51846 — High (CVSS 7.5): CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade…
CVE-2019-15302 — Medium (CVSS 6.5): The pad management logic in XWiki labs CryptPad before 3.0.0 allows a remote attacker (who has access to a Rich Text…
CVE-2025-49590 — Medium (CVSS 6.1): CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter…
CVE-2017-1000051 — Medium (CVSS 6.1): Cross-site scripting (XSS) vulnerability in pad export in XWiki labs CryptPad before 1.1.1 allows remote attackers to…

All CVEs affecting Xwiki Cryptpad →

Other CWE-284 (Improper Access Control) vulnerabilities

CVE-2026-50746 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi…
CVE-2026-46978 — Critical (CVSS 10.0): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). The…
CVE-2026-35308 — Critical (CVSS 10.0): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars).…
CVE-2026-35307 — Critical (CVSS 10.0): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that…
CVE-2026-46695 — Critical (CVSS 10.0): Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers…
CVE-2026-46840 — Critical (CVSS 10.0): Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are…

Browse all CWE-284 (Improper Access Control) vulnerabilities →