CVE-2025-62292

published 2025-10-10

CVE-2025-62292: In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and…

Priority P4 22 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C L I N A N

In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
sonarsource	sonarqube	>= 10.2 Commercial < 2025.3 Commercial	2025.3 Commercial
sonarsource	sonarqube	>= 10.2 Community < 25.6 Community	25.6 Community
sonarsource	sonarqube	>= 2025.1 LTA < 2025.1.3 LTA	2025.1.3 LTA

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-669