CronosWeb CVE-2025-41358
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege account
-
DeliveryLocate DocumentosPersonales endpoint
-
ExploitManipulate documentCode parameter
-
ExecutionEnumerate other users' object references
-
ImpactExfiltrate other users' personal documents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated CronosWeb account (PR:L) with access to the personal-documents module; the attacker manipulates the 'documentCode' parameter on '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas' to reference documents owned by other users. Limiting factors: exploitation is gated on possessing legitimate credentials to the application (not unauthenticated), and CronosWeb must be network-reachable to the attacker; affected only in versions prior to 25.00.00.12. No special non-default configuration is described, and no user interaction is required. |
| Impact | This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation requiring only low-privilege authentication and no user interaction - meaning any legitimate CronosWeb account holder can trivially abuse it. However, exploitation signals point to low real-world urgency: EPSS is only 0.34% (24th percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data. The vendor score of 8.3 (High) is driven largely by VC:H combined with SC:H (subsequent-system confidentiality high); the SC:H is questionable for a same-application IDOR that reads documents within the same system, and likely inflates the score - a straight CVSS 3.1 mapping yields roughly 6.5 (Medium). The impact is confidentiality-only (VI:N/VA:N), so no data tampering or availability loss. Net: a real authorization flaw worth patching, but the requirement for a valid account plus absence of active exploitation and public POC place it below internet-facing unauthenticated RCE priorities. |
| Exploit ScenarioDerived | An attacker with any valid, low-privilege CronosWeb account authenticates normally, then iterates or guesses the 'documentCode' parameter on the AdjuntarDocumentosPersonas endpoint to retrieve personal documents belonging to other users. No user interaction or elevated privileges are needed, and the sequential/predictable nature of object references (CWE-639) makes automated enumeration straightforward. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Authenticated users of i2A's CronosWeb can read personal documents belonging to other users by tampering with the 'documentCode' parameter on the '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas' endpoint. The flaw is a direct object reference (IDOR, CWE-639) affecting CronosWeb builds identified as prior to 25.00.00.12, so any organisation running an unpatched instance that is reachable by its user population is exposed to cross-user document disclosure; exploitation requires a valid account (CVSS PR:L) but no user interaction. There is no public exploit code and no confirmed active exploitation at the time of analysis, and EPSS is low at 0.34% (24th percentile), which places this as a moderate-priority confidentiality issue rather than a critical emergency.
RemediationAI
The primary fix is to upgrade CronosWeb to version 25.00.00.12 or later, which the advisory identifies as the reference version containing the correction; because the notice's phrasing ('prior to 25.00.00.12, inclusive') is ambiguous, confirm with i2A the exact build in which the ownership check was introduced before treating any specific build as safe, and review the INCIBE advisory at https://www.incibe.es/en/incibe-cert/notices/aviso/direct-reference-insecure-objects-idor-cronosweb-cronosweb-i2a for vendor-supplied details. No vendor workaround was published with this notice, so if upgrading cannot be done immediately, apply compensating controls: restrict reachability of the /CronosWeb application (and specifically the Modulos/Personas/DocumentosPersonales path) to trusted networks or VPN, at the cost of losing remote access for legitimate staff; reduce the number of accounts able to reach the personal-documents module to least privilege, which shrinks the pool of credentials an attacker could abuse but does not remove the flaw; and instrument logging or an API-gateway/WAF rule to flag requests where the submitted documentCode does not belong to the authenticated session, accepting that such rules are noisy, require a user-to-document mapping to be effective, and risk false positives on legitimate administrative workflows. A code-level server-side ownership check on documentCode is the only change that fully closes the issue short of upgrading.
Affected ProductsAI
i2A CronosWeb web application, in versions prior to 25.00.00.12 - with the vendor/INCIBE notice wording also rendering this as 'prior to 25.00.00.12, inclusive', which means the exact last-vulnerable build should be confirmed with the vendor. No CPE strings were provided in the available intelligence, so affected instances must be matched by product name and version banner rather than by machine-readable CPE. The affected component is the personal-documents functionality reachable at /CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas. The authoritative advisory is the INCIBE-CERT notice at https://www.incibe.es/en/incibe-cert/notices/aviso/direct-reference-insecure-objects-idor-cronosweb-cronosweb-i2a.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the application accepts a client-supplied identifier - the 'documentCode' parameter - and uses it to retrieve a document without verifying that the requesting session is entitled to that specific object. The endpoint path (Spanish-language 'Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas') indicates a personnel/personal-documents module within the CronosWeb web application, where document IDs are presumably sequential or otherwise enumerable, making substitution of another user's code trivial once an attacker holds a legitimate session. Impact is confidentiality-only and scoped to the application's own document store, with no integrity or availability effect described. Note the scoring divergence: the upstream CVSS 4.0 vector (8.3) adds Subsequent System Confidentiality (SC:H), whereas the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) treats the impact as confined to a single security scope; the practical consequence is the same - read access to documents the attacker should not see. No CPE identifiers were supplied, so affected builds are defined only by the vendor version string. The single public tag 'Authentication Bypass' should be treated with caution: this is not an unauthenticated bypass, it is a horizontally-scoped authorization failure inside an authenticated session.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Authenticated low-priv user (PR:L) over the network reads other users' documents via IDOR: confidentiality-only (C:H, I/A:N); scope unchanged as access stays within the same application.
Primary rating from Vendor (incibe).
CVSS VectorVendor: incibe
DescriptionCVE.org
Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated attacker to access other users' documents by manipulating the ‘documentCode’ parameter in '/CronosWeb/Modulos/Personas/DocumentosPersonales/AdjuntarDocumentosPersonas'.
Executive ViewAI
i2A CronosWeb, a document management module, contains an authenticated access control flaw that can expose personal documents to other valid users, creating privacy and regulatory risk for organizations that rely on it to store sensitive records. Leadership should care because the issue affects any user population with access to an unpatched instance, and the absence of a vendor patch means the exposure may persist until compensating controls or an upgrade are in place. No public exploit or active exploitation is identified, and EPSS is low, so this is a moderate-priority confidentiality issue rather than an emergency.
No vendor-released patch is identified at time of analysis. Interim mitigations include restricting CronosWeb access to trusted networks or VPN, enforcing least privilege and regular access reviews, monitoring and alerting on requests to the vulnerable endpoint, deploying WAF or virtual patching rules to block documentCode tampering, disabling the endpoint if not required, and isolating or decommissioning unsupported builds until an upgrade to 25.00.00.12 or later can be applied.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
GitHub PoC
Exploit-DB