CVE-2025-40676 PUBLISHED

Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC

Assigner: INCIBE
Reserved: 16.04.2025 Published: 07.10.2025 Updated: 07.10.2025

Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Research Infrastructure (BBMRI-ERIC). This vulnerability allows an attacker to access or modify unauthorised resources by manipulating requests that use the 'userID' parameter in '/api/v3/users/<userID>', which may result in the exposure or alteration of sensitive data

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 5.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	Low	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	BBMRI-ERIC
Product	Negotiator
Versions	Default: unaffected affected from 0 to 3.15.5 (excl.)

Solutions

The vulnerability has been fixed by the BBMRI-ERIC team in version 3.15.5.

Credits

Erlaitz Parreño Muñoz finder

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-bbmri-eric-negotiator

Problem Types

CWE-639 Authorization Bypass Through User-Controlled Key CWE