CVE-2025-24968: Business Logic And Unrestricted Project Deletion Lead To Take Over the System in reNgine
First published: Tue Feb 04 2025(Updated: )
reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, such as `penetration_tester` or `auditor` to delete all projects in the system. This can lead to a complete system takeover by redirecting the attacker to the onboarding page, where they can add or modify users, including Sys Admins, and configure critical settings like API keys and user preferences. This issue affects all versions up to and including 2.20. Users are advised to monitor the project for future releases which address this issue. There are no known workarounds.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| reNgine | <=2.20 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-24968?
CVE-2025-24968 is considered a critical vulnerability due to its potential for complete system takeover.
Who is affected by CVE-2025-24968?
CVE-2025-24968 affects users of reNgine versions up to and including 2.20.
How can I mitigate CVE-2025-24968?
To mitigate CVE-2025-24968, restrict user roles that can delete projects, such as `penetration_tester` or `auditor`.
What are the consequences of exploiting CVE-2025-24968?
Exploiting CVE-2025-24968 can allow an attacker to delete all projects in the system, potentially leading to a full system compromise.
Is there a patch available for CVE-2025-24968?
Yes, a patch for CVE-2025-24968 is expected to be included in future releases of reNgine.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/rengine
- canonical/rengine