CVE-2025-54461
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
ChatLuck contains an insufficient granularity of access control vulnerability in the Invitation of Guest Users feature. If exploited, an uninvited guest user may register itself as a guest user.
Risk Assessment
Unauthorized individuals may gain access to the ChatLuck environment as guests, potentially leading to information leakage or unwanted access to resources. This violates the organization's access control assumptions.
Recommendation
Update ChatLuck to a version containing the access control fix for guest invitations. Review the list of active guest accounts and remove any unauthorized ones.
Other vulnerabilities in ChatLuck
See all- CVE-2025-58115Medium
ChatLuck contains a cross-site scripting (XSS) vulnerability in the Guest User Sign-up feature. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.
- CVE-2025-53858Medium
ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.
Original NVD description (English source)
ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users. If exploited, an uninvited guest user may register itself as a guest user.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS