Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-04 | 2 | Disclosure2 |
| 2026-05-05 | 1 | Disclosure1 |
CVE-2025-67796 IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not e… https://www.cve.org/CVERecord?id=CVE-2025-67796
Post summary
The snippet announces an improper authorization flaw in IKUS Rdiffweb versions prior to 2.10.5, allowing token-based impersonation of users. No exploitation, patch, or PoC details are provided.
CVE-2025-67796 Improper Authorization Flaw in IKUS Rdiffweb Before 2.10.5 https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-67796
Post summary
The post announces CVE-2025-67796, describing an improper authorization flaw in IKUS Rdiffweb versions prior to 2.10.5, and directs readers to a vulnerability database for more information.
🚨*CVE* CVE-2025-67796 IKUS Rdiffweb before 2.10.5 has an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not e… https://www.cve.org/CVERecord?id=CVE-2025-67796 ----- Traducción: CVE-2025-67796 IKU… http://infoflow.cloud`
Post summary
The statement discloses an improper authorization flaw in IKUS Rdiffweb versions prior to 2.10.5 that enables token abuse for user impersonation.