CVE-2025-57817: Ethyca Fides OAuth Client Privilege Escalation Vulnerability
Summary
CVE-2025-57817: Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation. Affects ethyca-fides versions < 2.69.1. Fixed in 2.69.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ethyca Fides is an open-source privacy management platform designed to help organizations manage their data privacy compliance. It provides tools for data mapping, consent management, and user rights management. However, a vulnerability in its OAuth client creation and update endpoints allows unauthorized privilege escalation, potentially compromising user data and system integrity.
Vulnerability Detail
The vulnerability arises from inadequate authorization checks in the OAuth client creation and update endpoints of the Fides Webserver API. Specifically, the API fails to verify whether the user requesting to assign scopes to OAuth clients already possesses those scopes. This oversight enables highly privileged users, such as contributors, to assign themselves owner-level privileges, granting them access to sensitive functionalities like user management and system configuration. The potential ramifications include unauthorized access to critical system settings and user data, leading to severe security breaches.
How To Fix
Latest published version: 2.86.2 as of 22 Oct 2026
pip install --upgrade "ethyca-fides==2.86.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.69.1
This is the first release that contains the fix.
pip install --upgrade "ethyca-fides==2.69.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available for this vulnerability. The only solution is to upgrade to the patched version.
Conclusion
The CVE-2025-57817 vulnerability in Ethyca Fides poses a significant risk due to improper authorization in OAuth client management. Users are strongly encouraged to upgrade to version 2.69.1 or later to mitigate this risk and protect their systems from potential privilege escalation attacks.
See every vulnerability recorded for ethyca-fides →
FAQ
CVE-2025-57817 is a vulnerability in the Ethyca Fides Webserver API that allows privilege escalation through improper authorization in OAuth client management.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can allow contributor-level users to gain owner-equivalent privileges, leading to unauthorized access to user management and system configuration.
Yes, the vulnerability has been patched in Fides version 2.69.1. Users are advised to upgrade to this version or later.
Vulert is a monitoring tool that uses Pipfile.lock to alert users in real-time about open-source vulnerabilities in their software, helping maintain security.
References
Related vulnerabilities
Recent vulnerabilities recorded for ethyca-fides.
