← Vulnerability feed

Vulnerability record · CVE-2025-8261 · published 28 July 2025

CVE-2025-8261: Vaelsys improper authorization vulnerability

Vaelsys · Vaelsys

A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "Based on Vaelsys' analysis, the reported behavior does not allow actions beyond those already permitted to authenticated administrative users, and no change in system configuration or operational practices is necessary."

5.5 CVSS 4.0 Medium EPSS 0.65% · top 51.0% CWE-266 · CWE-266CWE-285 · Improper authorization
5.5CVSS 4.0 base score, v2 7.5
0.65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 1 tagged exploit
17 Jun 2026Last modified by NVD

Description

A weakness has been identified in Vaelsys VaelsysV4 4.1.0. This vulnerability affects unknown code of the file /grid/vgrid_server.php of the component User Creation Handler. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "Based on Vaelsys' analysis, the reported behavior does not allow actions beyond those already permitted to authenticated administrative users, and no change in system configuration or operational practices is necessary."

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/waiwai24/0101/blob/main/CVEs/Vaelsys/Unauthorized_User_Creation_Vulnerability_Exists_in_Vaelsys_V4_Pl ExploitThird Party Advisory
https://vaelsys.github.io/security-advisory/advisories/VSEC_V4_2025_07_0003.html
https://vuldb.com/submit/616924
https://vuldb.com/vuln/317849
https://vuldb.com/vuln/317849/cti

Track CVE-2025-8261 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

5.5CVE-2026-2952Vaelsys command injection vulnerabilityA flaw has been found in Vaelsys 4.1.0. This vulnerability affects unknown code of the file /tree/tree_server.php of the component HTTP POST Request …EPSS 7.3%5.5CVE-2025-8259Vaelsys command injection vulnerabilityA vulnerability was identified in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. Affected by this issue is the function execute_DataObjectProc of the file /gri…EPSS 3.2%1.3CVE-2025-8260Vaelsys broken cryptographic algorithm vulnerabilityA security flaw has been discovered in Vaelsys VaelsysV4 up to 5.1.0/5.4.0. This affects an unknown part of the file /grid/vgrid_server.php of the co…EPSS 0.24%10.0CVE-2026-48172LiteSpeed cPanel Plugin Redis Feature Privilege EscalationThe LiteSpeed User-End cPanel Plugin before 2.4.5 mishandles Redis enable/disable functionality, allowing privilege escalation that may reach root. I…KEVEPSS 1.0%analysed

Source: NIST National Vulnerability Database (record CVE-2025-8261), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.