PowerJob CVE-2025-11580

Exploitation requires only network reachability to the PowerJob web/console application (the /user/list endpoint); per the provided CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) no credentials, user interaction, or special attack prerequisites are needed, and the flaw is the absence of an authorization check on that function. The main limiting factors are network exposure (instances restricted to internal networks or behind an authenticating reverse proxy are far less exposed) and the affected version range (PowerJob up to and including 5.1.2); impact is bounded to disclosure of the user list with no write or availability effect.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no authentication or user interaction, which supports easy exploitation, but the impact is narrow: only VC:L (low confidentiality) with no integrity or availability impact, consistent with CWE-862 missing authorization exposing the /user/list function. The CVSS 4.0 base is 5.5 (medium). EPSS is 1.09% (65th percentile) - modest, indicating no evidence of broad automated exploitation despite the low attack complexity. A public exploit exists (E:P in the vector and the description stating the exploit was made public), raising the practical likelihood of opportunistic use, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV. Signals are broadly consistent - easy to reach but low-value information disclosure - so the realistic risk is unauthorized enumeration of user data rather than system compromise. Priority should be driven by how exposed the PowerJob console is (internet-facing deployments warrant prompter patching).

An attacker with network access to a PowerJob instance sends a request to the /user/list endpoint without authenticating and receives the application's user list because the endpoint fails to enforce authorization. A public exploit is available, so the request can be reproduced trivially to harvest account/user information for reconnaissance or follow-on attacks.