← Retour aux CVEs

CVE-2025-14025

HIGH

8.5

Description

A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).

Details CVE

Score CVSS v3.18.5

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteHIGH

Privileges requisLOW

Interaction utilisateurNONE

Publie1/8/2026

Derniere modification1/8/2026

Sourcenvd

Observations honeypot0

Faiblesses (CWE)

CWE-279

References

https://access.redhat.com/articles/7136004(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2026:0360(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2026:0361(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2026:0408(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2026:0409(secalert@redhat.com)

https://access.redhat.com/security/cve/CVE-2025-14025(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=2418785(secalert@redhat.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.