CVE-2025-1007: eclipse foundation openvsx Unverified Ownership

Vulnerability summary

CVE-2025-1007 is a medium (CVSS 6.9) Unverified Ownership vulnerability in eclipse foundation openvsx. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 42.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-02-2025
   PublishedVulnerability first disclosed.
2. 19-02-2025
   Last modifiedVulnerability information updated.

Description

In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in /user/namespace/{namespace}/details/logo and allowed a user to change the logo.

• CWE-283Unverified OwnershipThe product does not properly verify that a critical resource is owned by the proper entity.
• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.