Skip to content
Heist/ feed
Back to feed
Low

Security advisory

Type: advisorySources: OSVCVE: CVE-2025-43712

JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier because there is no privilege escalation in the context of the JHipster backend (the report only demonstrates that, after using JHipster to generate an application, one can make a non-functional admin screen visible in the front end of that application).

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-43712
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 09:34 UTC · Revision 1

Source evidence

CVE-2025-43712

core-osv · Original source

Published 25 Jul 2025, 00:00 UTC

JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier because there is no privilege escalation in the context of the JHipster backend (the report only demonstrates that, after using JHipster to generate an application, one can make a non-functional admin screen visible in the front end of that application).

osv:CVE-2025-43712
Complete source record
{
  "id": "d9b433107b20ee74e05431bffcef97bca0da2a156449e8a73afd462f68766ef4",
  "url": "https://osv.dev/vulnerability/CVE-2025-43712",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2025-43712",
    "summary": "JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier because there is no privilege escalation in the context of the JHipster backend (the report only demonstrates that, after using JHipster to generate an application, one can make a non-functional admin screen visible in the front end of that application).",
    "evidence": "osv:CVE-2025-43712",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2025-43712",
      "aliases": [
        "CVE-2025-43712"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/jhipster/generator-jhipster",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4dda5aa7dc4c57862bc25979a09bd4a79940ca02"
                }
              ],
              "database_specific": {
                "source": "DESCRIPTION",
                "extracted_events": [
                  {
                    "introduced": "0"
                  },
                  {
                    "fixed": "v.8.9.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v8.8.0",
            "v8.7.3",
            "v8.7.2",
            "v8.7.1",
            "v8.7.0",
            "v8.6.0",
            "untagged-94e0f1ee8d21ff6f87ca",
            "v8.5.0",
            "v8.4.0",
            "v8.2.1",
            "v8.1.0",
            "v8.0.0",
            "v8.0.0-rc.1",
            "v8.0.0-beta.3",
            "v8.0.0-beta.2",
            "v8.0.0-beta.1",
            "v7.9.3",
            "v7.9.0",
            "v7.8.1",
            "v7.8.0",
            "v7.7.0",
            "v7.6.0",
            "v7.5.0",
            "v7.4.1",
            "v7.4.0",
            "v7.3.1",
            "v7.3.0",
            "v7.2.0",
            "v7.1.0",
            "v7.0.1",
            "v7.0.0",
            "v7.0.0-beta.1",
            "v7.0.0-beta.0",
            "v6.10.0",
            "v6.9.1",
            "v6.9.0",
            "v6.8.0",
            "v6.7.1",
            "v6.7.0",
            "v6.6.0",
            "v6.5.1",
            "v6.4.1",
            "v6.4.0",
            "v6.3.1",
            "v6.3.0",
            "v6.2.0",
            "v6.1.2",
            "v6.1.1",
            "v6.1.0",
            "v6.0.1",
            "v6.0.0",
            "v6.0.0-beta.0",
            "v5.8.1",
            "v5.8.0",
            "v5.7.2",
            "v5.7.1",
            "v5.7.0",
            "v5.5.0",
            "v5.6.0",
            "v5.4.2",
            "v5.4.1",
            "v5.4.0",
            "v5.3.4",
            "v5.3.3",
            "v5.3.2",
            "v5.3.1",
            "v5.3.0",
            "v5.2.1",
            "v5.2.0",
            "v5.1.0",
            "v5.0.2",
            "v5.0.1",
            "v5.0.0",
            "v5.0.0-beta.3",
            "v5.0.0-beta.2",
            "v5.0.0-beta.1",
            "v5.0.0-beta.0",
            "v4.14.0",
            "v4.13.3",
            "v4.13.2",
            "v4.13.1",
            "v4.13.0",
            "v4.12.0",
            "v4.11.1",
            "v4.11.0",
            "v4.10.2",
            "v4.10.1",
            "v4.10.0",
            "v4.9.0",
            "v4.8.2",
            "v4.8.1",
            "v4.8.0",
            "v4.7.0",
            "v4.6.2",
            "v4.6.1",
            "v4.6.0",
            "v4.5.6",
            "v4.5.5",
            "v4.5.4",
            "v4.5.3",
            "v4.5.2",
            "v4.5.1",
            "v4.5.0",
            "v4.4.1",
            "v4.4.0",
            "v4.3.0",
            "v4.2.0",
            "v4.1.1",
            "v4.1.0",
            "v4.0.8",
            "v4.0.7",
            "v4.0.6",
            "v4.0.5",
            "v4.0.4",
            "v4.0.3",
            "v3.12.1",
            "v3.12.0",
            "v3.11.0",
            "v3.10.0",
            "v3.9.1",
            "v3.9.0",
            "v3.8.0",
            "v3.7.1",
            "v3.7.0",
            "v3.4.0",
            "v3.3.0",
            "v3.2.1",
            "v3.2.0",
            "v3.1.0",
            "v3.0.0",
            "v2.27.0",
            "v2.26.2",
            "v2.26.1",
            "v2.26.0",
            "v2.25.0",
            "v2.24.0",
            "v2.23.1",
            "v2.23.0",
            "v2.22.0",
            "v2.21.1",
            "v2.21.0",
            "v2.20.0",
            "v2.11.1",
            "v2.19.0",
            "v2.17.0",
            "v2.16.1",
            "v2.16.0",
            "v2.15.2",
            "v2.15.1",
            "v2.15.0",
            "v2.13.1",
            "v2.13.0",
            "v2.12.0",
            "v2.11.0",
            "v2.10.1",
            "v2.10.0",
            "v2.9.2",
            "v2.9.1",
            "v2.9.0",
            "v2.8.0",
            "v2.7.0",
            "v2.6.0",
            "v2.5.2",
            "v2.5.1",
            "v2.5.0",
            "v2.4.0",
            "v2.2.0",
            "v2.1.1",
            "v2.1.0",
            "v2.0.0",
            "v1.8.1",
            "v1.8.0",
            "v1.7.1",
            "v1.7.0",
            "v1.5.0",
            "v1.4.0",
            "v1.3.0",
            "v1.2.2",
            "v1.2.1",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.0",
            "v0.18.1",
            "v0.18.0",
            "v0.17.2",
            "v0.17.1",
            "v0.17.0",
            "v0.16.0",
            "v0.15.0",
            "v0.14.0",
            "v0.13.0",
            "v0.11.0",
            "v0.10.1",
            "v0.10.0",
            "v0.9.3",
            "v0.9.2",
            "v0.9.1",
            "v0.9.0",
            "v0.8.4",
            "v0.8.3",
            "v0.8.2",
            "v0.8.1",
            "v0.8.0",
            "v0.7.1",
            "v0.7.0",
            "v0.6.2",
            "v0.6.1",
            "v0.6.0",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.0",
            "v0.3.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43712.json"
          }
        }
      ],
      "modified": "2026-10-20T10:30:46.953373621Z",
      "provider": "osv",
      "references": [
        "https://firecompass.com/cve-2025-43712-jhipster-platform-privilege-escalation-vulnerability-discovered-by-firecompass-research-added-to-nist/",
        "https://groups.google.com/g/jhipster-dev/c/ATSlWkEjw2w",
        "https://medium.com/@hritikgodara/cve-2025-43712-privilege-escalation-via-response-manipulation-in-the-jhipster-platform-5e18c0434def",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43712.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-43712",
        "https://github.com/jhipster/generator-jhipster/releases"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-451"
        ],
        "isDisputed": true,
        "cna_assigner": "mitre",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43712.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-43712",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 379117,
  "published_at": "2025-07-25T00:00:00+00:00"
}