CVE-2025-58386

critical · 9.8

In Terminalfour 8 through 8.4.1.1, the userLevel parameter in the user management function is not subject to proper server-side authorization checks. A Power User can intercept and modify this parameter to assign the Administrator role to other existing lower-privileged accounts, or invite a new lower-privileged account and escalate its privileges. While manipulating this request, the Power User can also change the target account's password, effectively taking full control of it.

9.8

CVSS

0.3%

EPSS (exploit prob.)

27th

EPSS percentile

2025-12-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-285

Affected products

Vendor	Product	Affected versions
terminalfour	terminalfour	>= 8.0.0, < 8.4.1.2

Check a specific version with /api/v1/cve/match.

References

https://docs.terminalfour.com/release-notes/security-notices/cve-2025-58386/
https://terminalfour.com

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-58386