Insecure Direct Object Reference in BlackBerry AtHoc Management Console
CVE-2025-12766

5MEDIUM

Key Information:

Vendor

Blackberry

Status
Blackberry® Athoc® (onprem)
Vendor
CVE Published:
19 November 2025

What is CVE-2025-12766?

An Insecure Direct Object Reference (IDOR) vulnerability has been identified in the Management Console of BlackBerry AtHoc (OnPrem) version 7.21. This flaw allows unauthorized users to access sensitive information pertaining to other organizations utilizing the Interactive Warning System (IWS), potentially compromising the integrity and confidentiality of hosted data. Proper access controls and input validations are recommended to mitigate this risk.

Affected Version(s)

BlackBerry® AtHoc® (OnPrem) Windows 7.21

References

https://support.blackberry.com/pkb/s/article/140929

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

BlackBerry would like to thank Valiant Security Labs — Thea Younes for their involvement in helping protect our customers.
JSON
.