CVE-2025-26377

Summary

CVE-2025-26377 is a vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. An authenticated, low-privileged attacker can exploit this Missing Authorization issue (CWE-862) in maxprofile/users/routes.lua to remove users through crafted HTTP requests. This vulnerability could lead to significant consequences, including unauthorized account deletion and potential data loss. The flaw grants attackers more control than their granted privileges, posing a serious risk to the targeted system's security. It is essential for organizations using Q-Free MaxTime to apply the necessary patch to mitigate this issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.