What is CVE-2025-8261?

CVE-2025-8261 is a high-severity vulnerability in Vaelsys, classified under Incorrect Privilege Assignment. CVSS score: 7.3/10. Published 2025-07-28.

How severe is CVE-2025-8261?

High severity. CVSS v3 base score is 7.3 out of 10.

Is CVE-2025-8261 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Vaelsys

CVE-2025-8261

A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "Based on Vaelsys' analysis, the reported behavior does not allow actions beyond those already permitted to authenticated administrative users, and no change in system configuration or operational practices is necessary."

Published 2025-07-28 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

EPSS exploit prediction

EPSS: 0.006 (49.0th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 49.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000

Affected products

Vaelsys — versions 4.1.0
Vaelsys Vaelsysv4 — versions 4.1.0

Weakness classification (CWE)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

vuldb.com/vuln/317849 (technical-description, vdb-entry)
vuldb.com/vuln/317849/cti (signature, permissions-required)
vuldb.com/submit/616924 (third-party-advisory)
github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_User_Creation_Vuln… (Exploit, Third Party Advisory, exploit)
vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0003.html (related)

Frequently asked questions

What is CVE-2025-8261?: CVE-2025-8261 is a high-severity vulnerability in Vaelsys, classified under Incorrect Privilege Assignment. CVSS score: 7.3/10. Published 2025-07-28.
How severe is CVE-2025-8261?: High severity. CVSS v3 base score is 7.3 out of 10.
Is CVE-2025-8261 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.