Melis Platform CVE-2025-10352
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Melis Platform instance
-
DeliverySend unauthenticated POST to /melis/MelisCore/ToolUser/addNewUser
-
ExploitServer creates attacker-controlled admin account
-
ExecutionAuthenticate as new administrator
-
ImpactFull control of platform and data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond network reachability - remote unauthenticated exploitation (CVSS PR:N/UI:N/AC:L) against a Melis Platform instance whose melis-core administrative endpoint /melis/MelisCore/ToolUser/addNewUser is accessible to the attacker. The only meaningful limiting factor is exposure: the vulnerable endpoint must be reachable by the attacker (e.g. internet-facing or on a reachable network), and the instance must be running an unpatched version of Melis Platform. No authentication, no specific non-default feature toggle, and no user interaction are required. |
| Impact | This is a genuine high-priority vulnerability, not a CVSS-inflated paper risk. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes fully remote, unauthenticated, low-complexity exploitation with no user interaction, and the vulnerable-system impacts VC:H/VI:H/VA:H reflect that creating an attacker-controlled administrator account yields complete compromise of the application - consistent with CWE-862 (Missing Authorization). Publicly available exploit code exists (github-poc), which lowers the skill barrier and typically drives opportunistic scanning. The signals do, however, partially conflict: EPSS is only 0.33% (24th percentile), indicating low modeled probability of broad exploitation despite the public POC - this likely reflects the product's small deployment footprint rather than any difficulty of exploitation, since a working one-request POC against a niche CMS generates little internet-wide telemetry. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation. Net: trivially exploitable and fully impactful where Melis Platform is deployed, but real-world exposure is bounded by how rarely the product is run. Patch availability was not provided in the input and should be verified against the INCIBE-CERT advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a single crafted HTTP request to the exposed endpoint /melis/MelisCore/ToolUser/addNewUser, which fails to enforce authorization and creates a new administrator account. The attacker then logs in with those credentials and takes full control of the Melis Platform instance. A public POC for this exact flow is available (github.com/ivansmc00/CVE-2025-10352-POC), so exploitation requires no custom development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated attackers can create a fully privileged administrator account on Melis Platform by sending a request to the melis-core endpoint /melis/MelisCore/ToolUser/addNewUser, because that controller action performs no authorization check (CWE-862 Missing Authorization). The issue affects network-reachable Melis Platform instances running an unpatched melis-core module; no credentials, special feature flags, or user interaction are required (CVSS v3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, assessed 9.8; vendor/NVD scoring raises it to 9.3 under CVSS v4.0). Publicly available exploit code exists (a GitHub PoC), so weaponization is trivial, although EPSS currently rates near-term exploitation likelihood low at 0.33% (24th percentile) and there is no KEV entry confirming active exploitation. Successful exploitation yields complete compromise of the platform's confidentiality, integrity, and availability through the attacker-controlled admin account.
RemediationAI
No vendor-released patch was identified in the available data at time of analysis, so remediation must begin with exposure reduction: block external access to /melis/MelisCore/ToolUser/addNewUser at the reverse proxy, load balancer, or WAF (e.g. deny requests to the /melis/MelisCore/ path from untrusted sources), which stops the attack but will also prevent legitimate remote administrative user provisioning and should therefore be paired with an internal-only admin path or VPN. As a stronger compensating control, restrict the entire /melis back-office namespace to trusted management IP ranges or place it behind a VPN/zero-trust gateway; the trade-off is loss of convenient remote admin access. If melis-core user management is not required in a given deployment, disable or remove the melis-core module (or the ToolUser controller route) to eliminate the attack surface entirely, accepting that related back-office features will also stop working. Because the vulnerability allows silent creation of an administrator account, immediately audit the Melis user tables and application logs for unexpected accounts and POST requests to ToolUser/addNewUser, and rotate administrative credentials on any instance that may have been exposed. Monitor the INCIBE-CERT advisory (https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-melis-platform) and the Melis Technology vendor channel for the official fixed release, and apply it as soon as it is published; until then, treat the WAF/network restrictions as mandatory rather than optional.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 Missing Authorization: the ToolUser::addNewUser action in the melis-core module of Melis Platform is reachable over HTTP but fails to enforce authentication or role-based access control before executing user-provisioning logic. Melis Platform is a PHP-based CMS/e-commerce application framework whose modules (melis-core supplies user, rights, and back-office management) are routed through URLs such as /melis/MelisCore/<Controller>/<Action>. Because the addNewUser action is not gated, an anonymous request that mimics the expected parameters is sufficient to insert a new user record with administrative rights, giving the attacker a persistent, legitimate-looking back door into the back office. The CVSS v4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) and the independent CVSS v3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) agree that no privileges, user interaction, or attack-complexity barriers exist - network reachability of the endpoint is the only prerequisite. The assignment of CWE-862 rather than CWE-306 (Missing Authentication for Critical Function) reflects that the vulnerable controller likely assumes an upstream auth guard that does not apply to this route.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Unauthenticated remote request (AV:N/AC:L/PR:N/UI:N) creates an admin account granting full app control, so C/I/A all High; scope unchanged as impact stays within the application.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
DescriptionCVE.org
Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthenticated attacker to create an administrator account via a request to '/melis/MelisCore/ToolUser/addNewUser'.
Executive ViewAI
Melis Platform deployments running the unpatched melis-core module can be taken over by an unauthenticated attacker who creates a fully privileged administrator account through a single request, giving that attacker complete control over the platform's data and services. No vendor-released patch is identified at time of analysis, and publicly available exploit code exists, so every network-reachable instance should be treated as an urgent risk by the teams operating it. Leadership should care because exploitation converts an exposed web endpoint directly into total loss of confidentiality, integrity, and availability without requiring credentials or user interaction.
No vendor-released patch identified at time of analysis. Interim mitigations: remove internet reachability or restrict network access to Melis Platform instances running melis-core; block or filter requests to /melis/MelisCore/ToolUser/addNewUser at the reverse proxy, load balancer, or WAF; enforce network segmentation and VPN-only access for administrative interfaces; audit and alert on new or modified administrator accounts; and continuously monitor the vendor advisory for an official fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB