CVE-2025-26372

Name of the Vulnerable Software and Affected Versions: Q-Free MaxTime versions 2.11.0 and earlier

Description: The issue is related to missing authorization in the maxprofile/user-groups/routes.lua file, allowing an authenticated attacker with low privileges to remove users from groups via crafted HTTP requests, specifically targeting the maxprofile/user-groups/routes.lua endpoint. The username and other user-related variables are potentially vulnerable to manipulation.

Recommendations: For Q-Free MaxTime versions 2.11.0 and earlier, consider disabling access to the maxprofile/user-groups/routes.lua endpoint until a patch is available. Restrict privileges for low-privileged users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.