PT-2025-19784

CVE-2025-45616

Published

2025-05-05

Updated

2025-05-07

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions brcc version 1.2.0

Description The issue is related to incorrect access control in the "/admin/**" API endpoint, which allows attackers to gain access to Admin rights via a crafted request.

Recommendations For brcc version 1.2.0, as a temporary workaround, consider restricting access to the "/admin/**" API endpoint until a patch is available. Avoid using this endpoint with untrusted requests to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Racerz-Fighting

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers

CVE-2025-45616