CVE-2025-13084
High · 7.6CVSS
7.6
EPSS
0.3%
Published
Nov 26, 2025
CISA due date
—
The record
The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2025-59601 Information Disclosure when resetting device to factory default settings through… CWE-1230
- CVE-2026-45544 Nextcloud is an open source content collaboration platform. CWE-1230
- CVE-2026-49270 Exposure of Sensitive Information Through Metadata vulnerability in Apache ActiveMQ… CWE-1230
- CVE-2025-31959 HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded… CWE-1230
- CVE-2026-29055 Tandoor Recipes is an application for managing recipes, planning meals, and building… CWE-1230
- CVE-2026-27661 A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). CWE-1230