CVE-2025-26367

Summary

CVE-2025-26367 is a vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. It is classified as a CWE-862 "Missing Authorization" issue. An attacker with low-privileged access can exploit this flaw by making crafted HTTP requests to the maxprofile/user-groups/routes.lua file in the system. Successful exploitation enables the creation of arbitrary user groups, potentially compromising the security of the affected system.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.