Incorrect permission assignment in Wondershare Repairit
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA.
Summary
Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to a storage account token. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26902.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Wondershare | Repairit | 6.5.2 | — | No fix listed | CNA |
- Repairit VendorWondershare Affected 6.5.2 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wondershare:repairit:6.5.2:*:*:*:*:*:*:* | 6.5.2 | Vulnerable | Wondershare |
- cpe:2.3:a:wondershare:repairit:6.5.2:*:*:*:*:*:*:* Versions 6.5.2 Vulnerable ·Wondershare
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-10643
- 2026-10-03 Alias added: GHSA-g9jg-2495-pcx3
References
Advisory 1
More Wondershare Repairit vulnerabilities
- TI-2023-12399 An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote… CVSS 3.1HIGH 7.8
- TI-2025-09744 Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass… CVSS 3.0CRITICAL 9.4
Sources
- CVE-2025-10643 · CVE Program
- CVE-2025-10643 · NVD
- FIRST EPSS
- GHSA-g9jg-2495-pcx3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences