CVE-2025-14025
High · 8.5CVSS
8.5
EPSS
0.4%
Published
Jan 8, 2026
CISA due date
—
The record
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-46388 osquery is a SQL powered operating system instrumentation, monitoring, and analytics… CWE-279
- CVE-2026-4948 A flaw was found in firewalld. CWE-279
- CVE-2026-20062 A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA)… CWE-279
- CVE-2024-25621 containerd affected by a local privilege escalation via wide permissions on CRI directory CWE-279