{"id":"CVE-2025-58386","aliases":["EUVD-2025-200285","GHSA-gcr9-vvrm-c46v"],"status":"published","title":"In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not...","description":"In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new lower-privileged account and escalate its privileges. While manipulating this request, the Power User can also change the target account's password, effectively taking full control of it.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00362,"percentile":0.30454,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-285"],"published":"2025-12-02T00:00:00Z","modified":"2026-11-04T23:10:00Z","products":[{"vendor":"terminalfour","product":"terminalfour"}],"references":[{"url":"https://terminalfour.com","tags":["Product"]},{"url":"https://docs.terminalfour.com/release-notes/security-notices/cve-2025-58386/","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58386"},{"url":"https://docs.terminalfour.com/release-notes/security-notices/cve-2025-58386"},{"url":"https://github.com/advisories/GHSA-gcr9-vvrm-c46v"}],"sources":{"cve":[{"id":"CVE-2025-58386","description":"In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new lower-privileged account and escalate its privileges. While manipulating this request, the Power User can also change the target account's password, effectively taking full control of it.","status":"published","published":"2025-12-02T00:00:00Z","modified":"2025-12-03T15:13:08.72Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:32:37.027582Z"}],"euvd":[{"id":"EUVD-2025-200285","description":"In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new lower-privileged account and escalate its privileges. While manipulating this request, the Power User can also change the target account's password, effectively taking full control of it.","status":"published","published":"2025-12-02T00:00:00Z","modified":"2025-12-03T15:13:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:10.716009Z"}],"ghsa":[{"id":"GHSA-gcr9-vvrm-c46v","title":"In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not...","description":"In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new lower-privileged account and escalate its privileges. While manipulating this request, the Power User can also change the target account's password, effectively taking full control of it.","status":"published","published":"2025-12-02T18:30:36Z","modified":"2025-12-03T18:31:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:05:01.902395Z"}],"nvd":[{"id":"CVE-2025-58386","description":"In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new lower-privileged account and escalate its privileges. While manipulating this request, the Power User can also change the target account's password, effectively taking full control of it.","status":"published","published":"2025-12-02T18:15:48.007Z","modified":"2026-11-04T23:10:00.223Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-05T01:45:08.806554Z"}]}}