CVE-2025-48827 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows… | CVSS 10.0 CRITICAL

Description

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.

Metadata

CVE ID: CVE-2025-48827
State: PUBLISHED
Assigner: mitre
Reserved: 2025-05-27 00:00 UTC
Published: 2025-05-27 00:00 UTC
Last updated: 2025-05-27 18:03 UTC
Primary CWE: CWE-424
CWE-424 Improper Protection of Alternate Path
Vendor / Product: vBulletin / vBulletin
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
vBulletin	vBulletin	—	5.0.0 ≤ 5.7.5, 6.0.0 ≤ 6.0.3

Weakness (CWE)

CWE	Source	Description
CWE-424	cna	CWE-424 Improper Protection of Alternate Path

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References (2)