CVE-2025-66087

MediumCVSS 4.3

Published: 21/11/2025(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Missing Authorization vulnerability in Property Hive (PropertyHive plugin) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PropertyHive from n/a through <= 2.1.12.

Risk Assessment

An attacker could exploit the flaw to access functions or data they are not authorized for, potentially leading to unauthorized actions. This may compromise site security and user data.

Recommendation

Update the Property Hive plugin to a version later than 2.1.12 that fixes the vulnerability. Additionally, review access control configuration on the site.

Other vulnerabilities in Property Hive

CVE-2026-42729High
CVE-2026-42729 describes an improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS) vulnerabilities in the Property Hive application. This issue affects versions from n/a through 2.2.2 inclusive.

Original NVD description (English source)

Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS