Auth bypass in Tgstation Tgstation-Server
CVE-2025-21611
tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions regardless of their permissions. Notably, the WriteUsers right is unaffected so users may not use this bug to permanently elevate their account permissions. The fix is release in tgstation-server-v6.12.3.
EPSS: 0.005 (39.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Tgstation Tgstation-server — versions >= 6.11.0, < 6.12.3
- Tgstation13 Tgstation-server
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-21611?
- CVE-2025-21611 is a high-severity vulnerability in Tgstation Tgstation-Server, classified under Improper Authorization. CVSS score: 8.8/10. Published 2025-01-06.
- How severe is CVE-2025-21611?
- High severity. CVSS v3 base score is 8.8 out of 10.