Improper Access Control in microCLAUDIA by INCIBE

CVE-2025-41090

What is CVE-2025-41090?

The microCLAUDIA solution suffers from an improper access control vulnerability that permits authenticated users to execute unauthorized actions across different organizations' systems. By leveraging organization identifiers that can be acquired from a compromised endpoint or deduced manually, an attacker is capable of sending direct API requests. This flaw notably facilitates access between tenants, enabling attackers to list and manage assets remotely, uninstall agents, and delete critical vaccine configurations. Organizations using affected versions of microCLAUDIA must take immediate steps to mitigate this risk.

References