CVE-2025-55741: Unopim Package Allows Unauthorized Product Deletion via Mass-Delete Endpoint
Summary
CVE-2025-55741: UnoPim has Broken Access Control. Affects unopim/unopim versions < 0.3.1. Fixed in 0.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Unopim is an open-source package designed for managing product catalogs in e-commerce platforms. It allows users to create roles and assign privileges, enabling fine-grained access control for various actions, including product management. However, a critical vulnerability has been identified that undermines this access control mechanism, specifically allowing unauthorized deletion of products.
Vulnerability Detail
The vulnerability arises from a broken access control mechanism within the Unopim package. Users without the 'Delete' privilege for products are correctly restricted from deleting a single product through the standard endpoint. However, they can exploit the mass-delete endpoint to delete products, even when only one product ID is provided. This flaw can lead to unauthorized product deletions, resulting in data loss and potential business disruptions. The CVSS score for this vulnerability is 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
0.3.1
This is the first release that contains the fix.
composer require unopim/unopim:0.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the mass-delete endpoint for users who do not have the 'Delete' privilege. This can be implemented by modifying the access control rules in the application to ensure that only authorized users can access this endpoint.
Conclusion
The Unopim package has a critical vulnerability that allows unauthorized product deletions through the mass-delete endpoint. It is essential to update to the latest version to mitigate this risk and ensure proper access control is enforced.
See every vulnerability recorded for unopim/unopim →
FAQ
CVE-2025-55741 is a vulnerability in the Unopim package that allows unauthorized users to delete products via the mass-delete endpoint.
The vulnerability can lead to unauthorized product deletions, resulting in data loss and potential disruptions to business operations.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Update the Unopim package to version 0.3.1 or later using the command: composer update unopim/unopim.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just the composer.lock file, without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for unopim/unopim.
