CVE-2025-34293
High
Description
GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API. Authenticated requests to the API's object endpoints allow an authenticated user to request arbitrary user IDs and receive sensitive account data for those users, including the stored password and the account's security question and answer. The exposed recovery data and encrypted password may be used to reset or take over the target account.
SeverityHigh
CVSS8.6
Exploit probability—
ProductGN4 Publishing System
PublishedOct 24, 2025
First seenOct 24, 2025
How to fix
Update
- Naviga Global / Miles 33 GN4 Publishing System2.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Naviga Global / Miles 33 GN4 Publishing System | v < 2.6 | 2.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.