CYBER CODE RED

Get real-time updates on Telegram

P4

CVE-2025-13877: nocobase 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 2.0.0-alpha.0, 2.0.0-alpha.1, 2.0.0-alpha.2, 2.0.0-alpha.3, 2.0.0-alpha.4…

CVE-2025-13877. CVSS 3.1 base score 5.6 (MEDIUM, Vendor/CNA). EPSS 0.003 (percentile 0.2121), scored 17-Oct-2026.

Affected technology

nocobase · 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 2.0.0-alpha.0, 2.0.0-alpha.1, 2.0.0-alpha.2, 2.0.0-alpha.3, 2.0.0-alpha.4, 2.0.0-alpha.5, 2.0.0-alpha.6, 2.0.0-alpha.7, 2.0.0-alpha.8, 2.0.0-alpha.9, 2.0.0-alpha.10, 2.0.0-alpha.11, 2.0.0-alpha.12, 2.0.0-alpha.13, 2.0.0-alpha.14, 2.0.0-alpha.15, 2.0.0-alpha.16, 2.0.0-alpha.17, 2.0.0-alpha.18, 2.0.0-alpha.19, 2.0.0-alpha.20, 2.0.0-alpha.21, 2.0.0-alpha.22, 2.0.0-alpha.23, 2.0.0-alpha.24, 2.0.0-alpha.25, 2.0.0-alpha.26, 2.0.0-alpha.27, 2.0.0-alpha.28, 2.0.0-alpha.29, 2.0.0-alpha.30, 2.0.0-alpha.31, 2.0.0-alpha.32, 2.0.0-alpha.33, 2.0.0-alpha.34, 2.0.0-alpha.35, 2.0.0-alpha.36, 2.0.0-alpha.37
Vendor not specified by the source

Description’s affected range: up to 1.9.4/2.0.0-alpha.37

Component: JWT Service
Function: of
File: nocobase

Attack conditions (VulDB, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 2.9/10) rates confidentiality, integrity and availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

Published

CWE
CWE-320, CWE-321
CCR priority
22.5 /100 (P4)
CVSS 3.1
5.6 /10 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L · Vendor/CNA
EPSS
0.003 · percentile 0.2121 · 2026-10-17
KEV
no

Provenance

Stable permalink: https://cybercodered.org/item/cve-cve-2025-13877.html