Authorization Bypass Vulnerability in Profession Fit by Henkel CyberVM

CVE-2025-59797

What is CVE-2025-59797?

The authorization bypass flaw in Profession Fit versions allows an attacker to circumvent normal authentication mechanisms by directly requesting certain API endpoints, including '/api/challenges/{id}' and other sensitive URLs. This vulnerability could lead to unauthorized access to user management functions and other critical features, posing a significant risk to the security and integrity of user data.

References