What’s Vulnerable › Vulnerabilities

CVE-2021-25991: ifme - Improper Access Control leads to admin deactivation

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-29 · updated 2026-06-17
• Weakness: CWE-284

Description

In Ifme, versions v5.0.0 to v7.32 are vulnerable against an improper access control, which makes it possible for admins to ban themselves leading to their deactivation from Ifme account and complete loss of admin access to Ifme.

Affected products

• ifmeorg ifme: from 5.0.0 through 7.32

References

• https://github.com/ifmeorg/ifme/commit/d1f570c458d41667df801fc9c40a18b181a2d923
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25991
• https://github.com/ifmeorg/ifme/commit/d1f570c458d41667df801fc9c40a18b181a2d923
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25991

Get alerted when CVE-2021-25991 or the next vulnerability affects your stack