CVE-2025-53709: Access control issues impacting secure-upload service
Secure-upload is a data submission service that validates single-use tokens when accepting submissions to channels. The service only installed on a small number of environments.
Under specific circumstances, privileged users of secure-upload could have selected email templates not necessarily created for their enrollment when sending data upload requests. Authenticated and privileged users of one enrollment could have abused an endpoint to redirect existing submission channels to a dataset they control. An endpoint handling domain validation allowed unauthenticated users to enumerate existing enrollments. Finally, other endpoints allowed enumerating if a resource with a known RID exists across enrollments.
The affected service has been patched with version 0.815.0 and automatically deployed to all Apollo-managed Foundry instances.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53709?
CVE-2025-53709 has been rated with a high severity level due to possible unauthorized access from privileged users.
How do I fix CVE-2025-53709?
To fix CVE-2025-53709, update the Apollo Secure-upload software to version 0.815.0 or later.
What is the impact of CVE-2025-53709?
CVE-2025-53709 may allow privileged users to utilize incorrect email templates, potentially leading to unauthorized actions.
Who is affected by CVE-2025-53709?
CVE-2025-53709 affects users of Apollo Secure-upload prior to version 0.815.0.
What versions of Apollo Secure-upload are vulnerable to CVE-2025-53709?
Versions of Apollo Secure-upload prior to 0.815.0 are vulnerable to CVE-2025-53709.