What is the CVSS score of CVE-2025-13828?

CVE-2025-13828 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2025-13828?

Within 24 hours: Audit all user accounts with platform access and document composer activity logs; restrict non-admin user access to composer functionality immediately. Within 7 days: Implement network-level controls to isolate composer package repositories; conduct forensic review for unauthorized package installations. Within 30 days: Enforce strict role-based access controls limiting composer privileges to administrators only; establish continuous monitoring for suspicious package installation patterns.

CVE-2025-13828

EUVD-2025-200275 CRITICAL

Missing Authorization (CWE-862)

2025-12-02 security@mautic.org

GHSA-3fq7-c5m8-g86x

Authentication Bypass

9.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200275

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 17:16 nvd

CRITICAL 9.0

DescriptionCVE.org

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.

ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.