What’s Vulnerable › Vulnerabilities
CVE-2025-41078: Multiple vulnerabilities in Viafirma products
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-01-12 · updated 2026-06-17
- Weakness: CWE-863
Description
Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.
Affected products
- Viafirma Documents: before 3.7.139 — fixed in 3.7.139
- Viafirma Documents Compose: before 1.9.2 — fixed in 1.9.2
How to fix
Upgrade to a fixed version: Viafirma Documents 3.7.139; Viafirma Documents Compose 1.9.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-41078 or the next vulnerability affects your stack