CVE-2025-47411
Medium · 6.5Apache StreamPipes has Improper Privilege Management issue
CVSS
6.5
EPSS
15.3%
Published
Jan 1, 2026
CISA due date
—
The record
A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. This vulnerability allows an attacker to gain administrative control over the application by manipulating JWT tokens, which can lead to data tampering, unauthorized access and other security issues. This issue affects Apache StreamPipes: through 0.97.0. Users are recommended to upgrade to version 0.98.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.streampipes:streampipes-parent | 0.69.0 | 0.98.0 |
| maven | org.apache.streampipes/streampipes-parent | 0.69.0 | 0.98.0 |
Related vulnerabilities
- GHSA-5r2g-vphf-m5xc Apache StreamPipes has Improper Privilege Management issue Same vulnerability
- CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269
- CVE-2026-95837 containerd is an open-source container runtime. CWE-269
- CVE-2026-63349 AnyIO is a high level asynchronous concurrency and networking framework that works on top… CWE-269
- CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating… CWE-269
- CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. CWE-269
- CVE-2026-74925 The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role… CWE-269