What’s Vulnerable › Vulnerabilities

CVE-2025-55741: unopim/unopim allows unauthorized product deletion via mass-delete endpoint

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-08-22 · updated 2026-06-17
• Weakness: CWE-284

Description

UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete privilege for products are unable to delete individual products via the standard endpoint, as expected. However, these users can bypass intended access controls by issuing requests to the mass-delete endpoint, allowing them to delete products without proper authorization. This vulnerability allows unauthorized product deletion, leading to potential data loss and business disruption. The issue is fixed in version 0.3.1. No known workarounds exist.

Affected products

• unopim: before 0.3.1 — fixed in 0.3.1

How to fix

Upgrade to a fixed version: unopim 0.3.1. Check the vendor advisory for mitigations.

References

• https://github.com/unopim/unopim/commit/c14eebe653aafd8dc713ca729165177e63315989
• https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx
• https://www.youtube.com/watch?v=J_WV8fCXlJM
• https://github.com/unopim/unopim/security/advisories/GHSA-8p2f-fx4q-75cx
• https://www.youtube.com/watch?v=J_WV8fCXlJM

Get alerted when CVE-2025-55741 or the next vulnerability affects your stack