What is the CVSS score of CVE-2025-65089?

CVE-2025-65089 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Pro Macros are affected by CVE-2025-65089?

CVE-2025-65089 presents notable security risk, a missing authorization vulnerability rated CVSS 6.8. Attackers could gain access beyond their authorized level.. A patch is available.

How to fix or mitigate CVE-2025-65089?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Pro Macros CVE-2025-65089

MEDIUM

Missing Authorization (CWE-862)

2025-11-19 security-advisories@github.com

Atlassian Microsoft Authentication Bypass Pro Macros

6.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 19:23 vuln.today

CVE Published

Nov 19, 2025 - 18:15 nvd

MEDIUM 6.8

DescriptionGitHub Advisory

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0.

AnalysisAI

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authorization (CWE-862), which allows attackers to access resources or perform actions without proper authorization checks. XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to version 1.27.0, a user with no view rights on a page may see the content of an office attachment displayed with the view file macro. This issue has been patched in version 1.27.0. Affected products include: Xwiki Pro Macros. Version information: version 1.27.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement role-based access control, validate authorization on every request server-side, apply principle of least privilege.

CVE-2025-65089 vulnerability details – vuln.today

Back