CVE-2025-63562
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call several endpoints and perform create/update/delete actions on resources owned by arbitrary users by manipulating request parameters (e.g., owner or resource id).
Risk Assessment
This may allow unauthorized modification or deletion of other users' data, compromising integrity and confidentiality.
Recommendation
Update the platform to v1.0.2 or later and implement proper server-side authorization checks.
Other vulnerabilities in Summer Pearl Group Vacation Rental Management Platform
See all- CVE-2025-63563Medium
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 does not properly invalidate active user sessions after a password change. This allows an attacker with a valid session token to maintain access to the account even after the legitimate user changes their password.
- CVE-2025-63561High
Summer Pearl Group Vacation Rental Management Platform prior to 1.0.2 is susceptible to a Slowloris-style Denial-of-Service (DoS) condition in the HTTP connection handling layer, where an attacker that opens and maintains many slow or partially-completed HTTP connections can exhaust the server's connection pool and worker capacity, preventing legitimate users and APIs from accessing the service.
Original NVD description (English source)
Summer Pearl Group Vacation Rental Management Platform prior to v1.0.2 suffers from insufficient server-side authorization. Authenticated attackers can call several endpoints and perform create/update/delete actions on resources owned by arbitrary users by manipulating request parameters (e.g., owner or resource id).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS