CVE-2025-26373

Summary

CVE-2025-26373 is a vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. This issue, classified as CWE-862 "Missing Authorization," permits authenticated, low-privileged attackers to enumerate users through crafted HTTP requests on the user endpoint located in the maxprofile/users/routes.lua file. The missing authorization check exposes sensitive information, posing a security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.