CVE-2025-62292
Medium
Description
In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts.
SeverityMedium
CVSS4.3
Exploit probability—
Product
SonarQube
PublishedOct 10, 2025
First seenOct 10, 2025
Weakness typeCWE-669CWE-669
How to fix
Update
- SonarSource SonarQube25.6 Community, 2025.3 Commercial, 2025.1.3 LTA or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| SonarSource SonarQube | 10.2 Community ≤ v < 25.6 Community, 10.2 Commercial ≤ v < 2025.3 Commercial, 2025.1 LTA ≤ v < 2025.1.3 LTA | 25.6 Community, 2025.3 Commercial, 2025.1.3 LTA |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.