CVE-2025-57817: Ethyca Fides OAuth Client Privilege Escalation Vulnerability
Summary
CVE-2025-57817: Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation. Affects ethyca-fides versions < 2.69.1. Fixed in 2.69.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ethyca Fides is an open-source privacy management platform that helps organizations manage user data privacy and compliance. It provides features such as consent management, data subject requests, and privacy policy generation. However, a vulnerability in its OAuth client creation and update endpoints allows unauthorized privilege escalation, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from improper authorization checks in the OAuth client creation and update endpoints of the Fides Webserver API. Specifically, the API fails to verify that users requesting to assign scopes to OAuth clients already possess those scopes. This oversight allows users with 'client:create' or 'client:update' permissions to assign arbitrary scopes, potentially escalating their privileges to owner-level access. The ramifications include unauthorized access to user management, system configuration, and permission assignment capabilities, which should be restricted to higher privilege levels.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.69.1
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.69.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The only effective solution is to upgrade to the patched version.
Conclusion
The CVE-2025-57817 vulnerability in Ethyca Fides poses a significant risk due to improper authorization in OAuth client management. Users are strongly advised to upgrade to version 2.69.1 or later to mitigate this risk and protect sensitive functionalities from unauthorized access.
See every vulnerability recorded for ethyca-fides →
FAQ
CVE-2025-57817 is a vulnerability in the Ethyca Fides platform that allows unauthorized privilege escalation through improper authorization in OAuth client management.
Users of Ethyca Fides versions prior to 2.69.1 are affected, particularly those with contributor-level access who can create or update OAuth clients.
The vulnerability can lead to unauthorized access to sensitive functionalities, including user management and system configuration, allowing contributors to act with owner-level privileges.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
