CVE-2025-57817: high-severity vulnerability in ethyca fides
Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.6epss 0.4%
Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with `client:create` or `client:update` permissions to escalate their privileges to owner-level. Version 2.69.1 fixes the issue. No known workarounds are available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Affected products
ethyca · fidesRelated CVEs — ethyca fides
In the same product, most dangerous first.
CVE-2023-36827HIGHFides vulnerable to Path Traversal in Webserver APIEPSS 1.5%CVE-2024-38537NONEInclusion of Untrusted polyfill.io Code Vulnerability in fides.jsEPSS 1.4%CVE-2024-45053CRITICALRemote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating EngineEPSS 1.3%CVE-2024-31223MEDIUMFides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URLEPSS 1.1%CVE-2023-48224HIGHCryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fidesEPSS 1.0%CVE-2023-41319HIGHRemote Code Execution in Custom Integration Upload in FidesEPSS 0.9%