{"id":"CVE-2025-47425","aliases":["GHSA-rf8x-9mhr-49wg"],"status":"published","title":"Reflex vulnerable to private state fields modification","description":"### Summary\n\nA user on the website can modify any private field on their own state.\n\n### Details\n\nAn event meant to modify client side storage had access to modify any field on the state for the given user. This includes non-client side ones and most importantly private fields. This still requires the actor to guess the name for the private fields.\n\n### Impact\n\nIf one of the States in your app can be modified to allow the user into a different role or a different user this allows the actor to act as someone else or as admin.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2025-05-15T16:15:19Z","modified":"2025-05-15T16:15:20Z","fixes":[{"ecosystem":"PyPI","package":"reflex","fixed_in":["0.4.9.post1","0.5.10.post1","0.6.8.post1","0.7.1.post1","0.7.2.post1","0.7.3.post1","0.7.4.post1","0.7.5.post1","0.7.6.post1","0.7.7.post1","0.7.8.post1","0.7.9.post1","0.7.10.post1","0.7.11"],"sources":["ghsa"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.2.7"},{"fixed":"0.4.9.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.4.9.post1, \u003c 0.5.10.post1","events":[{"fixed":"0.5.10.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.5.10.post1, \u003c 0.6.8.post1","events":[{"fixed":"0.6.8.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.6.8.post1, \u003c 0.7.1.post1","events":[{"fixed":"0.7.1.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.1.post1, \u003c 0.7.2.post1","events":[{"fixed":"0.7.2.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.2.post1, \u003c 0.7.3.post1","events":[{"fixed":"0.7.3.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.3.post1, \u003c 0.7.4.post1","events":[{"fixed":"0.7.4.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.4.post1, \u003c 0.7.5.post1","events":[{"fixed":"0.7.5.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.5.post1, \u003c 0.7.6.post1","events":[{"fixed":"0.7.6.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.6.post1, \u003c 0.7.7.post1","events":[{"fixed":"0.7.7.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.7.post1, \u003c 0.7.8.post1","events":[{"fixed":"0.7.8.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.8.post1, \u003c 0.7.9.post1","events":[{"fixed":"0.7.9.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.9.post1, \u003c 0.7.10.post1","events":[{"fixed":"0.7.10.post1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"reflex","ranges":[{"type":"UNPARSED","raw":"\u003e 0.7.10.post1, \u003c 0.7.11","events":[{"fixed":"0.7.11"}]}]}],"references":[{"url":"https://github.com/reflex-dev/reflex/security/advisories/GHSA-rf8x-9mhr-49wg"},{"url":"https://github.com/reflex-dev/reflex/commit/cf8f5dbcbdd996f3478a7be660993f9c760ede36"},{"url":"https://github.com/advisories/GHSA-rf8x-9mhr-49wg"}],"sources":{"ghsa":[{"id":"GHSA-rf8x-9mhr-49wg","title":"Reflex vulnerable to private state fields modification","description":"### Summary\n\nA user on the website can modify any private field on their own state.\n\n### Details\n\nAn event meant to modify client side storage had access to modify any field on the state for the given user. This includes non-client side ones and most importantly private fields. This still requires the actor to guess the name for the private fields.\n\n### Impact\n\nIf one of the States in your app can be modified to allow the user into a different role or a different user this allows the actor to act as someone else or as admin.","status":"published","published":"2025-05-15T16:15:19Z","modified":"2025-05-15T16:15:20Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:38:43.172412Z"}]}}