CVE-2025-26378

Summary

CVE-2025-26378 is a missing authorization vulnerability affecting Q-Free MaxTime versions 2.11.0 and below. An authenticated, low-privileged attacker can exploit this issue in maxprofile/users/routes.lua to reset passwords, even those of administrator accounts, through carefully crafted HTTP requests. This flaw exposes sensitive information and compromises system security.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.