What is the CVSS score of CVE-2025-69727?

CVE-2025-69727 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of INDEX-EDUCATION PRONOTE are affected by CVE-2025-69727?

Organizations using INDEX-EDUCATION PRONOTE should be aware of moderate risk from CVE-2025-69727, a improper access control vulnerability rated CVSS 5.3.

How to fix or mitigate CVE-2025-69727?

Within 30 days: Identify affected systems running INDEX-EDUCATION PRONOTE and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

INDEX-EDUCATION PRONOTE CVE-2025-69727

EUVD-2025-208763 MEDIUM

Improper Access Control (CWE-284)

2026-03-16 mitre

Authentication Bypass

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 18:38 euvd

EUVD-2025-208763

Analysis Generated

Mar 16, 2026 - 18:38 vuln.today

CVE Published

Mar 16, 2026 - 00:00 nvd

MEDIUM 5.3

DescriptionCVE.org

An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components (index.js and composeUrlImgPhotoIndividu) allow the construction of direct URLs to user profile images based solely on predictable identifiers such as user IDs and names. Due to missing authorization checks and lack of rate-limiting when generating or accessing these URLs, an unauthenticated or unauthorized actor may retrieve profile pictures of users by crafting requests with guessed or known identifiers.

AnalysisAI

A security vulnerability in INDEX-EDUCATION PRONOTE (CVSS 5.3) that allows the construction of direct urls. Remediation should follow standard vulnerability management procedures.