CVE-2025-67793: drivelock from 24.1 (inclusive), through 24.1.6 (inclusive), from 24.2 (inclusive), through 24.2.8 (inclusive), from…

Affected technology

drivelock · from 24.1 (inclusive), through 24.1.6 (inclusive)
drivelock

drivelock · from 24.2 (inclusive), through 24.2.8 (inclusive)
drivelock

drivelock · from 25.1 (inclusive), before 25.1.6 (exclusive)
drivelock

n/a · n/a
Vendor not specified by the source

Description’s affected range: through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.