Missing Authorization Vulnerability in Zipline Product from Diced
CVE-2025-71460

2.3LOW

Key Information:

Vendor

Diced

Status
Zipline
Vendor
CVE Published:
13 November 2026

What is CVE-2025-71460?

The vulnerability in Zipline prior to version 4.2.1 stems from a missing authorization check in the /api/user/files/transaction endpoint. This oversight allows authenticated users to manipulate files owned by other users without appropriate permissions. By knowing a specific file ID, attackers can submit requests to edit or delete target files, potentially leading to significant data breaches. It is crucial for users of Zipline to update to the latest version to safeguard against unauthorized file access and maintain data integrity.

Affected Version(s)

zipline 0 < 4.2.1

zipline 4.2.1

References

https://github.com/diced/zipline/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/zipline-before-4.2.1...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

smashedr
.