Authorization Bypass in ETQ Reliance by ETQ
CVE-2025-34140

8.7HIGH

Key Information:

Vendor

Etq

Status
Reliance Cg (legacy)
Reliance Nxg (saas)
Vendor
CVE Published:
22 July 2025

What is CVE-2025-34140?

An authorization bypass vulnerability has been identified in the ETQ Reliance SaaS platforms (legacy CG and NXG). This issue allows unauthenticated attackers to bypass access controls by appending certain URI suffixes to specific API endpoints, enabling them to retrieve limited sensitive resources. The vulnerability resulted from a misconfiguration in the API authorization logic. Remediation has been implemented in the subsequent versions, SE.2025.1 and SE.2025.1.2, which address this security issue effectively.

Affected Version(s)

Reliance CG (legacy) *

Reliance NXG (SaaS) *

Reliance NXG (SaaS) * < 2025.1.2

References

https://www.etq.com/product-overview/
product
https://www.etq.com/blog/etq-reliance-security-update/
vendor-advisorypatch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adam Kues and Shubham Shah of Assetnote
.
CVE-2025-34140 : Authorization Bypass in ETQ Reliance by ETQ