Insecure Direct Object Reference in Negotiator by BBMRI-ERIC
CVE-2025-40676

5.3MEDIUM

Key Information:

Vendor

Bbmri-eric

Status
Negotiator
Vendor
CVE Published:
7 October 2025

What is CVE-2025-40676?

An Insecure Direct Object Reference vulnerability in Negotiator v3.15.2 from BBMRI-ERIC allows attackers to manipulate the 'userID' parameter in API requests to access or alter unauthorized resources. This weakness can lead to significant data exposure or modification, risking sensitive information being improperly accessed or manipulated.

Affected Version(s)

Negotiator 0 < 3.15.5

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Erlaitz Parreño Muñoz
JSON
.
CVE-2025-40676 : Insecure Direct Object Reference in Negotiator by BBMRI-ERIC