What is the CVSS score of CVE-2025-47555?

CVE-2025-47555 has a CVSS 3.1 base score of 3.8 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Themeum Tutor LMS are affected by CVE-2025-47555?

A critical authorization bypass vulnerability in Tutor LMS (versions ≤3.9.4) allows attackers to exploit misconfigured access controls, potentially granting unauthorized users access to sensitive…

How to fix or mitigate CVE-2025-47555?

Within 24 hours: Identify all systems running Tutor LMS ≤3.9.4 and assess current user access patterns for anomalies. Within 7 days: Implement compensating controls including WAF rules to restrict suspicious authorization requests, enforce network segmentation to limit LMS access, and disable non-essential features if possible. Within 30 days: Monitor vendor for patch availability, prepare upgrade plan to patched version immediately upon release, and conduct access control audit to remediate any unauthorized access that may have occurred.

Themeum Tutor LMS CVE-2025-47555

LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-01-22 audit@patchstack.com

Authentication Bypass

3.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.8 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Apr 23, 2026 - 15:43 NVD

HIGH LOW

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.1 (HIGH) 3.8 (LOW)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:15 nvd

HIGH 8.1

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.

AnalysisAI

Technical ContextAI

Classified as CWE-639 (Authorization Bypass Through User-Controlled Key). Affects Themeum Tutor LMS tutor. Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.