PowerJob List - Authorization Bypass

mediumseverity

1.1%likelihood of exploitation, next 30 days

66%of all CVEs are less likely

Readycheck to confirm it

PowerJob = 5.1.2 contains a broken access control caused by missing authorization in /user/list function, letting remote attackers access unauthorized resources, exploit requires no special privileges.

Impact

Remote attackers can access unauthorized resources, potentially leading to data exposure or privilege escalation.

Fix

Update to the latest version beyond 5.1.2.

How to confirm it

Send: GET /user/list
Positive when: contains "{\"success\":true" and "\"username\":" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-11580 -u <target>

The full check

id: CVE-2025-11580

info:
  name: PowerJob List - Authorization Bypass
  author: DhiyaneshDk
  severity: medium
  description: |
    PowerJob = 5.1.2 contains a broken access control caused by missing authorization in /user/list function, letting remote attackers access unauthorized resources, exploit requires no special privileges.
  impact: |
    Remote attackers can access unauthorized resources, potentially leading to data exposure or privilege escalation.
  remediation: |
    Update to the latest version beyond 5.1.2.
  reference:
    - https://github.com/PowerJob/PowerJob/issues/1127
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11580
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"PowerJob"
    fofa-query: title="PowerJob"
    product: powerjob
    vendor: powerjob
  tags: cve,cve2025,powerjob,auth-bypass,oss,vuln

http:
  - raw:
      - |
        GET /user/list HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"success":true'
          - '"username":'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from