CVE-2024-25635
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.72%
- CWE
- CWE-612
- Published
- 2024-02-19
- Last modified
- 2026-03-13
Affected products
- alfio-event alf.io
Weakness type
Related vulnerabilities
- CVE-2019-25605 — EquityPandit 1.0 Insecure Logging Information Disclosure
- CVE-2025-3660 — Petlibro Smart Pet Feeder Platform through 1.7.31 Broken Access Control via API endpoint
- CVE-2025-3654 — Petlibro Smart Pet Feeder Platform through 1.7.31 Information Disclosure via API endpoint
- CVE-2025-3653 — Petlibro Smart Pet Feeder through 1.7.31 Platform Improper Access Control via API endpoint
- CVE-2025-57756 — Contao discloses sensitive information in the front end search index
- CVE-2024-49071 — Windows Defender Information Disclosure Vulnerability
- CVE-2023-4560 — Improper Authorization of Index Containing Sensitive Information in omeka/omeka-s
- CVE-2022-41918 — Issue with fine-grained access control of indices backing data streams