Unauthorized Article Creation Vulnerability in Scratch Channel by The Scratch Channel
CVE-2025-59416

7.2HIGH

Key Information:

Vendor

The-scratch-channel

Status
Tsc-web-client
Vendor
CVE Published:
17 September 2025

What is CVE-2025-59416?

A security flaw in the Scratch Channel allows users to manipulate admin privileges and create articles without proper authorization. This occurs because the API uses a POST request that lacks sufficient validation on user actions. The vulnerability enables individuals to perform operations intended for authorized administrators, thus potentially compromising the integrity of the content published on the site. This issue has been resolved in version 1.2.

Affected Version(s)

tsc-web-client < 1.2

References

https://github.com/The-Scratch-Channel/tsc-web-client/sec...
x_refsource_CONFIRM

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-59416 : Unauthorized Article Creation Vulnerability in Scratch Channel by The Scratch Channel