// For flags

CVE-2025-21611

tgstation-server's role authorization incorrectly OR'd with user's enabled status

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions regardless of their permissions. Notably, the WriteUsers right is unaffected so users may not use this bug to permanently elevate their account permissions. The fix is release in tgstation-server-v6.12.3.

tgstation-server es una herramienta de escala de producción para la administración de servidores BYOND. Antes de la versión 6.12.3, los roles utilizados para autorizar métodos de API se combinaban incorrectamente con OR en lugar de AND con el rol utilizado para determinar si un usuario estaba habilitado. Esto permite a los usuarios habilitados acceder a la mayoría de las acciones autorizadas, pero no a todas, independientemente de sus permisos. En particular, el derecho WriteUsers no se ve afectado, por lo que los usuarios no pueden usar este error para elevar permanentemente los permisos de su cuenta. La solución se publica en tgstation-server-v6.12.3.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
None
Automatable
No
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2024-12-29 CVE Reserved
  • 2025-01-06 CVE Published
  • 2025-01-06 CVE Updated
  • 2025-01-07 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-285: Improper Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Tgstation
Search vendor "Tgstation"
 Tgstation-server
Search vendor "Tgstation" for product "Tgstation-server"
 >= 6.11.0 < 6.12.3
Search vendor "Tgstation" for product "Tgstation-server" and version " >= 6.11.0 < 6.12.3"
en
Affected