Access Control Vulnerability in ChatLuck Inviting Guests
CVE-2025-54461

6.9MEDIUM

Key Information:

Vendor

Neojapan Inc.

Status
Chatluck
Vendor
CVE Published:
16 October 2025

What is CVE-2025-54461?

ChatLuck has a vulnerability that allows unauthorized guest users to register themselves due to insufficient granularity in access control mechanisms during the invitation process. This flaw could potentially be exploited by an attacker to gain uninvited access to the chat environment, thereby compromising user data and overall security.

Affected Version(s)

ChatLuck V6.6 R2.0 and earlier

References

https://www.chatluck.com/support/package/mainte/pchatluck...
https://jvn.jp/en/jp/JVN13030751/

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-54461 : Access Control Vulnerability in ChatLuck Inviting Guests