CVE-2025-26376

Summary

CVE-2025-26376 is a vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. This issue is classified as a CWE-862 "Missing Authorization" vulnerability, which allows authenticated, low-privileged attackers to manipulate user data through specially crafted HTTP requests. By exploiting this missing authorization check in the maxprofile/users/routes.lua file, cybercriminals can modify user information, potentially causing significant security and privacy concerns. The vulnerability poses a risk to organizations that have not yet patched their systems against this known issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.