CVE-2025-65681
Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
- Record
CVE-2025-65681- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-524, CWE-384
- Updated
- 2026-11-02
EUVDEUVD-2025-199747
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
- Record
EUVD-2025-199747- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gq25-78jf-v78c
Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
- Record
GHSA-gq25-78jf-v78c- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
NVD
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
- Record
CVE-2025-65681- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-384, CWE-524
- Updated
- 2026-11-05
OSV
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
- Record
CVE-2025-65681- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-05
OSVGHSA-gq25-78jf-v78c
Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
- Record
GHSA-gq25-78jf-v78c- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVPYSEC-2025-219
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-control HTTP headers and client-side session checks.
- Record
PYSEC-2025-219- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tutorPyPI |
through 20.0.2 | None known |
tutorPyPI |
through 20.0.2, plus listed versions 0.10.20.2.112.0.112.0.2 Show 45 moreShow less12.0.312.0.412.1.012.1.112.1.212.1.312.1.412.1.512.1.612.1.712.2.013.0.013.0.113.0.213.0.313.1.013.1.113.1.1013.1.1113.1.213.1.313.1.413.1.513.1.613.1.713.1.813.1.913.2.013.2.113.2.213.2.313.3.013.3.113.3.214.0.014.0.114.0.214.0.314.0.414.0.514.1.014.1.114.1.214.2.014.2.1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Rivek619/CVE-2025-65681 | 2025-11-24 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-65681 is a low vulnerability (CVSS 3.3) in Edly Tutor, published November 26, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. No source names a fixed version.
References
github.com/overhangio/tutor
docs.tutor.edly.io
nvd.nist.gov/vuln/detail/CVE-2025-65681
Left out here: 55 versions. The JSON record has them.