CVE-2026-25427
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The eRoom plugin versions up to 1.7.1 contain a broken access control vulnerability, allowing subscribers unauthorized access to functions reserved for higher roles.
Risk Assessment
The risk involves privilege escalation by subscribers, potentially leading to unauthorized access to sensitive data or administrative functions.
Recommendation
Immediately update the eRoom plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in eRoom
See all- CVE-2026-114175Medium
The eRoom plugin by DigitalME, versions up to 1.7.1, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-114176Medium
The DigitalME eRoom plugin (eroom-zoom-meetings-webinar) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects eRoom versions up to and including 1.7.1.
- CVE-2026-62038High
Unauthenticated Broken Authentication in the eRoom plugin up to version 1.7.1. An attacker can bypass authentication mechanisms and gain unauthorized access.
- CVE-2026-25405High
The eRoom plugin version 1.7.1 and earlier contains an SQL Injection vulnerability exploitable by users with Contributor role.
Original NVD description (English source)
Subscriber Broken Access Control in eRoom <= 1.7.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS