CVE-2025-55741: unopim/unopim allows unauthorized product deletion via mass-delete endpoint
Summary In Unopim, it is possible to create roles and choose the privileges. However, users without the “Delete” privilege for Products cannot delete a single product via the standard endpoint (expected behavior), but can still delete products via the mass-delete endpoint, even when the request contains only one product ID.
Severity: High CVSS Score 8.1 (CVSS 3.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Category: Broken Access Control / Missing Authorization (OWASP A01:2021) Impact: Unauthorized product deletion -> data loss, possible business disruption
Affected Behavior Single delete (enforced): DELETE /admin/catalog/products/{id} returns 401 with "This action is unauthorized" for users lacking the Delete privilege.
Mass delete (not enforced): POST /admin/catalog/products/mass-delete allows deletion without the Delete privilege. This occurs for both multiple IDs and a single ID submitted to the bulk endpoint.
PoC A video was captured in Burp Suite for a proof of concept. The cookies were used directly from Burp Suite and rendered the My Account page to prove what cookies belong to what users. The video PoC is listed in references.
Impact Unauthorized product deletion -> data loss, possible business disruption
Other sources
UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-55741?
CVE-2025-55741 has a medium severity due to unauthorized product deletion capabilities when privileges are not properly enforced.
How do I fix CVE-2025-55741?
To fix CVE-2025-55741, upgrade UnoPim to version 0.3.1 or later.
What is the impact of CVE-2025-55741?
The impact of CVE-2025-55741 allows unauthorized users to delete products they should not have permission to delete.
Who is affected by CVE-2025-55741?
Users of UnoPim version 0.3.0 and earlier who lack delete privileges are affected by CVE-2025-55741.
What versions of UnoPim are vulnerable to CVE-2025-55741?
UnoPim versions 0.3.0 and earlier are vulnerable to CVE-2025-55741.