IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2025-12-19 15:15

MODIFIED

2025-12-19 15:15

EPSS (Prob. Exploit)

0.33%

Top 73.4%

DATA SOURCES:

NVD 🔗 2025-12-19 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-11-08 OSV 🔗 2026-11-08

> DESCRIPTION

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

2 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition

19/12/2025 15:15

Source: NVD

📊 ENRICHISSEMENT 19/01/2026 17:38

CVEPROJECT

Champ modifié: CVE Project

Ancienne valeur:

Non

Nouvelle valeur:

Oui

Total des modifications: 1 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.md

https://github.com/turms-im/turms