CVE-2025-51306
CVE-2025-51306 is a medium-severity vulnerability in Gatling with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1259.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- EPSS exploit prediction: 0% (29th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-23856
- Weakness: CWE-1259
- Affected product: Gatling
- Published:
- Last modified:
Description
In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incorrect session management.
Frequently asked questions
- What is CVE-2025-51306?
- In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to incorrect session management.
- How severe is CVE-2025-51306?
- CVE-2025-51306 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
- Is CVE-2025-51306 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-51306?
- CVE-2025-51306 affects Gatling. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-51306?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-51306 have an EU (EUVD) identifier?
- Yes. CVE-2025-51306 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-23856.
- When was CVE-2025-51306 published?
- CVE-2025-51306 was published on 2025-08-06 and last updated on 2026-06-17.
References
- https://gatling.io/products
- https://github.com/Flo354/vulnerabilities/blob/main/gatling-enterprise/CVE-2025-51306-broken-logout.md
- https://github.com/Flo354/vulnerabilities/blob/main/gatling-enterprise/CVE-2025-51306-change-permissions-not-reflected.md
- https://github.com/Flo354/vulnerabilities/tree/main/gatling-enterprise
Affected products (1)
- cpe:2.3:a:gatling:gatling:*:*:*:*:enterprise:*:*:*
More vulnerabilities in Gatling
- CVE-2025-51308 — Medium (CVSS 5.3): In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a…
Other CWE-1259 vulnerabilities
- CVE-2024-36533 — Critical (CVSS 9.8): Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining…
- CVE-2024-29371 — High (CVSS 7.5): In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web…
- CVE-2026-25700 — High (CVSS 7.2): Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer:…
- CVE-2025-56207 — Medium (CVSS 6.5): A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an…
- CVE-2024-4598 — Medium (CVSS 6.5): An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich…
- CVE-2025-27955 — Medium (CVSS 6.5): Clinical Collaboration Platform 12.2.1.5 has a weak logout system where the session token remains valid after logout…