What’s Vulnerable › Vulnerabilities

CVE-2025-62604: MeterSphere logic flaw allows retrieval of arbitrary user information

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-22 · updated 2026-10-19
• Weakness: CWE-200

Description

MeterSphere is an open source continuous testing platform. Prior to version 2.10.25-lts, a logic flaw allows retrieval of arbitrary user information. This allows an unauthenticated attacker to log in to the system as any user. This issue has been patched in version 2.10.25-lts.

Affected products

• metersphere: before 2.10.25 — fixed in 2.10.25

How to fix

Upgrade to a fixed version: metersphere 2.10.25. Check the vendor advisory for mitigations.

References

• https://github.com/metersphere/metersphere/commit/b984fe74e84711ff326b0a348807c31fadf134af
• https://github.com/metersphere/metersphere/releases/tag/v2.10.25-lts
• https://github.com/metersphere/metersphere/security/advisories/GHSA-vj5x-7374-rf96

Get alerted when CVE-2025-62604 or the next vulnerability affects your stack