Improper access control in JHipster
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing, Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-451 and CWE-284.
Summary
JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application. NOTE: this is disputed by the Supplier because there is no privilege escalation in the context of the JHipster backend (the report only demonstrates that, after using JHipster to generate an application, one can make a non-functional admin screen visible in the front end of that application).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-43712
References
Other 4
- https://github.com/jhipster/generator-jhipster/releases
- https://medium.com/@hritikgodara/cve-2025-43712-privilege-escalation-via-response-manipulation-in-the-jhipster-platform-5e18c0434def
- https://groups.google.com/g/jhipster-dev/c/ATSlWkEjw2w
- https://firecompass.com/cve-2025-43712-jhipster-platform-privilege-escalation-vulnerability-discovered-by-firecompass-research-added-to-nist/
More jhipster vulnerabilities
- TI-2022-08628 SQL Injection when creating an application with Reactive SQL backend CVSS 3.1HIGH 8.1
- TI-2025-22380 CWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit Framework CVSS 3.1HIGH 7.7
- TI-2026-69607 Stored cross-site scripting in JHipster generated applications CVSS 3.1HIGH 7.6
- TI-2019-12273 A class generated by the Generator in JHipster before 6.3.0 and JHipster Kotlin through… CVSS 3.1CRITICAL 9.8
- TI-2026-69614 SQL injection in JHipster reactive applications via sort parameter CVSS 3.1HIGH 8.8
- TI-2015-08085 JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken… CVSS 3.1HIGH 7.5
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences