Which versions of Windu Cms are affected by CVE-2025-59111?

Organizations using Windu CMS should be aware of notable risk from CVE-2025-59111, a incorrect authorization vulnerability rated CVSS 6.9. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2025-59111?

Within 30 days: Identify affected systems running user editing functionality. Malicious attacker can send a GE and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Windu Cms CVE-2025-59111

Q: What is the CVSS score of CVE-2025-59111?

CVE-2025-59111 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Incorrect Authorization (CWE-863)

2025-11-18 cvd@cert.pl

Authentication Bypass Windu Cms Windu

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:22 vuln.today

CVE Published

Nov 18, 2025 - 15:16 nvd

MEDIUM 6.9

DescriptionCVE.org

Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI.

Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250.

AnalysisAI

Windu CMS is vulnerable to Broken Access Control in user editing functionality. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. Windu CMS is vulnerable to Broken Access Control in user editing functionality. Malicious attacker can send a GET request which allows privileged users to delete Super Admins which is not possible with GUI. Only version 4.1 was tested and confirmed as vulnerable. This issue was fixed in version 4.1 build 2250. Affected products include: Windu Windu Cms. Version information: version 4.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.