Turms IM Server CVE-2025-66911

Exploitation requires a valid authenticated account on the Turms IM server (CVSS PR:L); any such account can invoke the vulnerable handleQueryUserOnlineStatusesRequest() in UserServiceController.java to query arbitrary users' online status, device info, and login timestamps against a default configuration - no special feature toggle or non-default setting is implied by the description. The limiting factor is that unauthenticated outsiders cannot exploit it: an attacker must first obtain or register a server account, and the leaked data is presence/device metadata rather than message content or credentials.

This is a medium-severity broken access control / authorization flaw (CWE-284), not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N, 6.5) shows a network-reachable, low-complexity attack but requires an authenticated account (PR:L), and impact is confidentiality-only (no integrity or availability loss). Publicly available exploit code exists (referenced GitHub report), which raises practical risk, but there is no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct signals. The input rates confidentiality High, but the disclosed data is user presence metadata (online status, device information, login timestamps) rather than credentials or message contents, so the real confidentiality impact is arguably Low - I independently assess C:L (see assessed vector). Net: a genuine privacy/IDOR issue worth patching on exposed Turms deployments, but the authentication requirement and metadata-only disclosure keep real-world risk moderate rather than urgent.

An attacker who holds or registers any valid account on a Turms IM server sends a crafted user-online-status query for victim user IDs they are not authorized to see. Because handleQueryUserOnlineStatusesRequest() performs no authorization check, the server returns each target's online status, device information, and last login timestamps, enabling presence tracking and reconnaissance of arbitrary users. A public exploit/report is already available, lowering the effort to reproduce.