CVE-2025-11580
📋 TL;DR
PowerJob versions up to 5.1.2 have a missing authorization vulnerability in the /user/list endpoint that allows unauthorized access to user information. This affects all PowerJob deployments using vulnerable versions. Attackers can remotely exploit this to view sensitive user data without proper authentication.
💻 Affected Systems
- PowerJob
📦 What is this software?
Powerjob by Powerjob
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to all user information including potentially sensitive account details, leading to data breach and privilege escalation opportunities.
Likely Case
Unauthorized users access user lists containing usernames, roles, and potentially other account metadata, enabling reconnaissance for further attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to unauthorized data viewing within the application scope.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues, making exploitation straightforward for attackers with basic knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.1.3 or later
Vendor Advisory: https://github.com/PowerJob/PowerJob/issues/1127
Restart Required: Yes
Instructions:
1. Upgrade PowerJob to version 5.1.3 or later. 2. Restart the PowerJob service. 3. Verify the /user/list endpoint now requires proper authorization.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to PowerJob endpoints using firewall rules or network segmentation
Reverse Proxy Authentication
allImplement authentication at reverse proxy level before requests reach PowerJob
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach PowerJob endpoints
- Monitor access logs for unauthorized requests to /user/list endpoint
🔍 How to Verify
Check if Vulnerable:
Check if PowerJob version is 5.1.2 or earlier and test if /user/list endpoint returns data without proper authenticationCheck Version:
Check PowerJob application logs or configuration files for version informationVerify Fix Applied:
After upgrade, verify /user/list endpoint requires authentication and returns appropriate error for unauthorized requests📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /user/list endpoint
- Multiple failed authentication attempts followed by successful /user/list access
Network Indicators:
- Unusual traffic patterns to /user/list endpoint from unexpected sources
SIEM Query:
source="powerjob" AND (uri_path="/user/list" AND response_code=200) AND NOT (user_authenticated=true)