Nomysem CVE-2025-1161

The attacker must already hold a low-privileged authenticated session on the Nomysem application (PR:L), must induce a separate user to perform an interaction that completes the exploit (UI:R), and must satisfy non-trivial preconditions reflected by AC:H - typically a specific application state, timing window, or configuration that is not under the attacker's direct control. Exploitation is limited to deployments of NomySoft Nomysem at versions released through May 2025; the flaw is not reachable purely unauthenticated, not reachable without victim interaction, and the description does not name a specific feature toggle, so the precise vulnerable API surface should be verified against the USOM/vendor advisory before scoping mitigations.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H paints a nuanced picture: the issue is reachable over the network and yields full CIA impact, but it requires an authenticated low-privileged account, user interaction from a victim, and high attack complexity (meaning the attacker must win a race, satisfy preconditions, or rely on configuration the attacker does not control). No EPSS score, KEV listing, SSVC decision, or POC reference is included in the provided data, so probabilistic exploitation signals are absent rather than 'low' - that distinction matters. The realistic priority is moderate: a 7.1 base score with AC:H and UI:R typically indicates a real but not opportunistic flaw, more attractive for targeted abuse against known Nomysem deployments than for mass exploitation. Key data is missing - there is no vendor advisory text, no confirmed fix version, and no exploitation telemetry - so defenders should treat the severity as the upper bound until USOM/vendor details clarify the exact exploitation path.

An attacker who has obtained or registered a low-privileged Nomysem account sends a crafted request that invokes a privileged backend API path, then lures an authenticated higher-privileged user (for example, by getting them to open a link or perform an action inside the application) to satisfy the UI:R requirement and complete the privilege escalation. On success, the attacker gains administrative-level capabilities within Nomysem, yielding full confidentiality, integrity, and availability impact over the application's data and functions. No public exploit identified at time of analysis, so this scenario is reconstructed from the CVSS vector rather than from observed tradecraft.