CVE-2025-48827: Critical severity vbulletin vulnerability
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48827?
CVE-2025-48827 is considered a critical vulnerability due to its potential for unauthorized access to protected API methods.
How do I fix CVE-2025-48827?
To mitigate CVE-2025-48827, update your vBulletin software to the latest version that addresses this vulnerability.
Which versions of vBulletin are affected by CVE-2025-48827?
CVE-2025-48827 affects vBulletin versions 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3.
Can unauthenticated users exploit CVE-2025-48827 to access data?
Yes, unauthenticated users can exploit CVE-2025-48827 to invoke methods on protected API controllers.
What specific method pattern should I be aware of in CVE-2025-48827?
The vulnerable method pattern in CVE-2025-48827 is identified as /api.php?method=protectedMethod.