Auth bypass in Wildrikku Octoprint-Spoolmanager
CVE-2025-62169
OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks. This issue has been patched in versions 1.8.0a3 of the testing branch and 1.7.8 of the stable branch. The impact of this vulnerability is greatly reduced when using OctoPrint version 1.11.2 and newer.
Vulnerability class: Broken Authentication
EPSS: 0.004 (35.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Wildrikku Octoprint-spoolmanager — versions < 1.8.0a3, < 1.7.8
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-62169?
- CVE-2025-62169 is a high-severity vulnerability in Wildrikku Octoprint-Spoolmanager, classified under Improper Authentication. CVSS score: 8.1/10. Published 2025-10-23.
- How severe is CVE-2025-62169?
- High severity. CVSS v3 base score is 8.1 out of 10.