CVE-2025-11580: PowerJob Package Missing Authorization Vulnerability
Summary
CVE-2025-11580: PowerJob has Missing Authorization in its /user/list file. Affects tech.powerjob:powerjob versions < 5.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PowerJob is an open-source job scheduling framework designed for distributed systems, enabling users to manage and execute jobs efficiently across various environments. It provides features such as job monitoring, scheduling, and management through a user-friendly interface. However, versions up to 5.1.2 are susceptible to a critical vulnerability that compromises user authorization in the '/user/list' functionality.
Vulnerability Detail
A significant vulnerability has been identified in PowerJob versions up to 5.1.2, specifically affecting the '/user/list' endpoint. This vulnerability arises from inadequate authorization checks, allowing unauthorized users to access sensitive user information. The flaw can be exploited remotely, potentially leading to unauthorized data exposure and manipulation. The public availability of the exploit increases the urgency for users to address this issue promptly.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the '/user/list' endpoint through network security measures, such as firewall rules or API gateway configurations, to limit exposure until the package is updated.
Conclusion
The missing authorization vulnerability in PowerJob versions up to 5.1.2 poses a significant risk to user data security. Users are strongly encouraged to update to version 5.1.3 or later to mitigate this risk. Additionally, temporary workarounds can be implemented to restrict access until the update is applied.
See every vulnerability recorded for tech.powerjob:powerjob →
FAQ
The vulnerability is a missing authorization issue in the '/user/list' functionality of PowerJob, allowing unauthorized access to user data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include unauthorized access to sensitive user information and potential manipulation of user data, which can lead to data breaches.
Yes, a patch is available in version 5.1.3 and later of the PowerJob package. Users are advised to upgrade to this version.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for tech.powerjob:powerjob.
