Campcodes Advanced Voting Management System CVE-2025-14889

No vendor-released patch has been identified at time of analysis. Organizations deploying Campcodes Advanced Voting Management System 1.0 should immediately contact the vendor at https://www.campcodes.com/ to request a security update or patch version addressing the authorization bypass in /admin/voters_edit.php. As interim compensating controls, restrict administrative dashboard access (the /admin/ directory) to a minimal set of trusted IP addresses using network-level filtering or web application firewall rules, enforce multi-factor authentication for all administrative accounts to reduce the risk of compromised credentials, implement audit logging on the voters_edit.php endpoint to detect unauthorized password modification attempts, and consider applying input validation or object-level authorization checks at the application layer if vendor support is unavailable. These mitigations do not eliminate the vulnerability but significantly raise the bar for exploitation by reducing the number of authenticated users with access to the vulnerable function.