OpenText Flipper CVE-2025-8053

Exploitation requires ALL of: (1) an existing authenticated low-privilege user account on the target (PR:L); (2) adjacent-network access to the Flipper instance, not remote internet reach (AV:A); (3) the specific precondition that access-control security levels are incorrectly/insufficiently configured, which is the named root cause and corresponds to the present attack requirement (AT:P); and (4) active user interaction during the attack (UI:A). These stacked limiting factors - authentication, network adjacency, dependence on a misconfiguration, and user interaction - sharply constrain realistic exploitation and explain the 1.0 base score. The resulting unauthorized backend-API access yields only Low confidentiality, integrity, and availability impact with no scope change.

This is a genuinely low-priority issue across nearly every signal, not a high-CVSS flaw masquerading as low risk - the vendor-assigned CVSS 4.0 base score is 1.0, among the lowest possible for a scored vulnerability. The vector (CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:A) shows multiple stacked barriers: adjacent-network access only (AV:A, not internet-reachable), an already-authenticated low-privilege account (PR:L), a present attack requirement (AT:P, meaning exploitation depends on specific non-guaranteed conditions), and active user interaction (UI:A). Impact is uniformly Low with no scope change (VC:L/VI:L/VA:L, SC:N/SI:N/SA:N), consistent with an authorization-granularity weakness (CWE-1220) rather than full compromise. The EPSS score of 0.26% (16th percentile) reinforces low real-world exploitation likelihood, and there is no CISA KEV listing and no public exploit identified at time of analysis - all signals agree, so there is no conflict to flag. The one caveat is contextual rather than technical: 'Flipper' is an obscure OpenText product with no independent corroboration beyond the vendor's own knowledge-base reference, so impact severity rests entirely on the vendor self-assessment.

An authenticated low-privilege user on the same adjacent network segment as a Flipper 3.1.2 instance leverages incorrectly configured access-control security levels to issue requests to backend API functions that should be restricted to higher-privileged roles. Because exploitation requires an existing account, local/adjacent positioning, and active user interaction, the practical effect is limited unauthorized read/modify access rather than full takeover. No public exploit identified at time of analysis.