CVE-2025-64349
ELOG user profile missing authorization
Summary
ELOG user profile missing authorization
Original description
The description as published by the source.
ELOG allows an authenticated user to modify another user's profile. An attacker can edit a target user's email address, then request a password reset, and take control of the target account. By default, ELOG is not configured to allow self-registration.
References
- advisory github.com
- advisory nvd.nist.gov
- patch bitbucket.org
- patch bitbucket.org
- web raw.githubusercontent.com
- web cve.org