OpenText Flipper CVE-2025-8049

Exploitation targets an incorrectly configured access-control security level in OpenText Flipper 3.1.2 (CWE-1220, insufficient granularity of access control). Per the description, the attacker is a low-privilege user of the application who then escalates privileges, implying an existing authenticated foothold is needed despite the vector's PR:N. Exploitation is further limited by high attack complexity (AC:H) and required user interaction (UI:P), meaning it is not a straightforward single-request attack and depends on specific application state or a victim action; impact is confined to the application (SC:N/SI:N/SA:N) with only Low-severity effect on each of confidentiality, integrity, and availability.

This is a genuinely low-priority issue, consistent across nearly all signals. The vendor-assigned CVSS 4.0 base score is only 2.3, reflecting high attack complexity (AC:H), required user interaction (UI:P), and uniformly Low impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N). EPSS reinforces this with a 0.28% exploitation probability (18th percentile - below average). There is no CISA KEV listing and no public proof-of-concept, so there is no public exploit identified at time of analysis. NOTE A CONFLICT: the CVSS 4.0 vector encodes PR:N (no privileges required), yet the description explicitly states the flaw 'could allow a low-privilege user to elevate privileges,' which implies the attacker must first hold a low-privilege authenticated account (PR:L). This discrepancy should be verified with OpenText; it does not change the overall low-risk conclusion but affects whether the attacker needs a foothold. Net assessment: a low-severity privilege-escalation weakness with no evidence of real-world exploitation - routine patch prioritization, not urgent.

An attacker who already holds a low-privilege account in OpenText Flipper 3.1.2 interacts with an incorrectly configured access-control security level and performs an action that lifts their effective privileges within the application. Because the CVSS vector specifies high attack complexity and required user interaction, successful exploitation is conditional and non-trivial, and no public exploit code is known to exist.