What’s Vulnerable › Vulnerabilities
CVE-2025-1007: Improper Authorization in /user/namespace/{namespace}/details
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-02-19 · updated 2026-06-17
- Weakness: CWE-283
Description
In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.
Affected products
- Eclipse Foundation Eclipse Open VSX: from 0.9.0 before 0.19.1 — fixed in 0.19.1
How to fix
Upgrade to a fixed version: Eclipse Foundation Eclipse Open VSX 0.19.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-1007 or the next vulnerability affects your stack