CVE-2025-12924

MediumCVSS 4.3

Published: 10/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

25th percentile - higher than 25% of all known CVEs

Summary

A missing authorization vulnerability was identified in rymcu forest in the GlobalResult function of src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The attack can be initiated remotely. The product uses a rolling release model, so no specific version information is available.

Risk Assessment

An unauthenticated attacker can remotely access functions they should not have permissions for, potentially leading to unauthorized operations. Lack of version information makes impact assessment difficult.

Recommendation

Apply vendor patches or update to the latest version as soon as available. Until then, restrict access to bank API endpoints and enforce authorization checks.

Other vulnerabilities in rymcu forest

CVE-2025-63687Medium
An issue was discovered in rymcu forest through commit f782e85 (2025-09-04) in the doBefore function in src/main/java/com/rymcu/forest/core/service/security/AuthorshipAspect.java, allowing authorized attackers to delete arbitrary users' posts.

Original NVD description (English source)

A vulnerability was identified in rymcu forest up to de53ce79db9faa2efc4e79ce1077a302c42a1224. This issue affects the function GlobalResult of the file src/main/java/com/rymcu/forest/web/api/bank/BankController.java. The manipulation leads to missing authorization. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS