CVE-2025-24899: Disclosure of Sensitive User Information via API in reNgine
reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where an insider attacker with any role (such as Auditor, Penetration Tester, or Sys Admin) can extract sensitive information from other reNgine users. After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as username, password, email, role, first name, last name, status, and activity information by making a GET request to /api/listVulnerability/. This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24899?
CVE-2025-24899 is considered a high severity vulnerability due to its potential for insider attacks that can compromise sensitive information.
How do I fix CVE-2025-24899?
To fix CVE-2025-24899, update reNgine to version 2.2.1 or later, which addresses the vulnerability.
Who is affected by CVE-2025-24899?
CVE-2025-24899 affects all users of reNgine version up to 2.2.0, including Auditors, Penetration Testers, and Sys Admins.
What type of information can be extracted due to CVE-2025-24899?
CVE-2025-24899 allows an insider attacker to extract sensitive user information stored within the reNgine application.
What should organizations do regarding CVE-2025-24899?
Organizations using reNgine should monitor for unauthorized access and update to the fixed version to mitigate risks associated with CVE-2025-24899.