Authorization Flaw in Secure-upload Service from Apollo

CVE-2025-53709

What is CVE-2025-53709?

The Secure-upload service from Apollo is designed to validate single-use tokens for data submissions. However, under certain conditions, authenticated and privileged users can exploit the service by selecting email templates not intended for their enrollment. Additionally, these users may redirect submission channels to a dataset they control, compromising the integrity of the data submission process. Furthermore, unauthenticated users can exploit an endpoint to enumerate existing enrollments, revealing sensitive information. The affected service has been updated to version 0.815.0 to address these issues.

References