CVE-2025-8053
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
An insufficient granularity of access control vulnerability in opentext Flipper allows exploitation of incorrectly configured access control security levels. A low-privilege user can interact with the backend API without sufficient privileges. This issue affects Flipper 3.1.2.
Risk Assessment
This vulnerability enables low-privilege users to access backend functionality, potentially leading to unauthorized operations and data leakage. The risk is high in environments where Flipper is used for feature flag management.
Recommendation
Upgrade opentext Flipper to the vendor-patched version. Also review and harden access control configuration in the backend API.
Other vulnerabilities in opentext Flipper
See all- CVE-2025-8050Medium
OpenText Flipper version 3.1.2 contains a path traversal vulnerability due to external control of file name or path. This could allow a user to access files hosted on the server.
- CVE-2025-8052High
SQL Injection vulnerability in opentext Flipper allows SQL Injection. The vulnerability could allow a low privilege user to interact with the database in unintended ways and extract data by interacting with the HQL processor. This issue affects Flipper: 3.1.2.
- CVE-2025-8049High
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low-privilege user to elevate privileges within the application. This issue affects Flipper: 3.1.2.
- CVE-2025-8048Medium
External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. A user can submit a stored local file path and then download the specified file by requesting the stored document ID. This issue affects Flipper 3.1.2.
Original NVD description (English source)
Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could allow a low privilege user to interact with the backend API without sufficient privileges. This issue affects Flipper: 3.1.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS