CVE-2025-41091: Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), consisting of a lack of adequate validation of user input, allowing an authenticated user to access to calendar details using unauthorised internal identifiers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41091?
CVE-2025-41091 is classified as a high severity vulnerability due to its potential for unauthorized access to sensitive calendar details.
How do I fix CVE-2025-41091?
To fix CVE-2025-41091, update BOLD Workplanner to version 2.5.25 or later, which resolves the Insecure Direct Object Reference issue.
What impact does CVE-2025-41091 have on users?
CVE-2025-41091 allows authenticated users to exploit inadequate user input validation and access unauthorized internal calendar identifiers.
Is CVE-2025-41091 a widespread issue?
CVE-2025-41091 affects all versions of BOLD Workplanner prior to 2.5.25, potentially impacting many users still on older versions.
Who is affected by CVE-2025-41091?
Any authenticated user of BOLD Workplanner versions prior to 2.5.25 may be affected by CVE-2025-41091 if they can exploit the Insecure Direct Object Reference.