CVE-2025-10820: Fuyang Platform Auth Bypass Vulnerability

CVE-2025-10820 Overview

CVE-2025-10820 is an improper authorization vulnerability in the fuyang_lipengjun platform version 1.0. The flaw resides in the TopicController handler that serves the /topic/queryAll endpoint. Authenticated remote attackers can manipulate the request to access topic data outside their authorization scope. Public exploit details have been disclosed, increasing the likelihood of opportunistic abuse against exposed instances. The weakness is classified as [CWE-266] Incorrect Privilege Assignment.

Critical Impact
Low-privileged remote users can invoke /topic/queryAll and retrieve topic records they should not be authorized to view, resulting in limited confidentiality loss.

Affected Products

fuyang_lipengjun platform 1.0
Component: fuyang_lipengjun:platform
CPE: cpe:2.3:a:fuyang_lipengjun:platform:1.0.0:*:*:*:*:*:*:*

Discovery Timeline

2025-09-22 - CVE-2025-10820 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10820

Vulnerability Analysis

The vulnerability affects the TopicController class that maps to the /topic/queryAll route. The controller returns topic entities without enforcing an authorization check tied to the caller's role or ownership. Any authenticated user with low privileges can invoke the endpoint and receive results intended for privileged administrators. The attack complexity is low, requires no user interaction, and is executable over the network. Impact is limited to confidentiality of topic data, with no reported effect on integrity or availability.

Root Cause

The root cause is a missing authorization enforcement layer in the queryAll handler of TopicController. Authentication alone gates the endpoint, and no role or scope check restricts callers to their permitted dataset. This matches the [CWE-266] category, where privileges are assigned in a manner that grants unintended access. The endpoint effectively behaves as a public administrative query for any authenticated principal.

Attack Vector

An attacker with a valid low-privilege session issues an HTTP request to /topic/queryAll. The server executes the query and returns the full topic collection without filtering by the caller's authorization scope. Because exploit details are public through the referenced VulDB and Cnblogs write-ups, attackers can automate discovery against exposed deployments. See the VulDB entry #325177 and the Cnblogs Security Post for technical write-ups.

No verified proof-of-concept code is published in a structured exploit database. The exploitation pattern is a straightforward authenticated HTTP GET request against the vulnerable endpoint, so no synthetic code is required to describe the attack.

Detection Methods for CVE-2025-10820

Indicators of Compromise

Unexpected HTTP GET requests to /topic/queryAll originating from non-administrative user sessions.
Large or repeated response payloads from /topic/queryAll correlated with low-privilege session identifiers.
Access log entries showing enumeration patterns against /topic/* endpoints from a single source IP.

Detection Strategies

Instrument web application logs to record the authenticated principal, role, and endpoint for every request to TopicController routes.
Baseline normal callers of /topic/queryAll and alert on invocations by user roles that historically never access the endpoint.
Deploy a web application firewall rule that flags requests to /topic/queryAll when the session token does not carry an administrative claim.

Monitoring Recommendations

Forward application access logs and authentication events to a centralized analytics platform for correlation across sessions and endpoints.
Track response size and record count returned by /topic/queryAll and alert on statistical outliers.
Monitor for scripted user agents and rapid sequential requests targeting /topic/* paths.

How to Mitigate CVE-2025-10820

Immediate Actions Required

Restrict network exposure of the fuyang_lipengjun platform 1.0 administrative endpoints to trusted management networks.
Implement a reverse-proxy authorization check that validates administrative role membership before forwarding requests to /topic/queryAll.
Rotate session tokens and audit recent access logs for the affected endpoint to identify prior abuse.

Patch Information

No vendor patch or security advisory has been published in the referenced sources at the time of NVD publication. Operators should track the upstream fuyang_lipengjun/platform repository for a fix that adds a role check to the TopicController.queryAll method. Review the VulDB CTI entry #325177 for updates.

Workarounds

Add a server-side authorization filter or interceptor that rejects calls to /topic/queryAll from non-administrative roles.
Disable or remove the /topic/queryAll route in production builds if the endpoint is not required by end users.
Enforce IP allow-listing at the ingress layer so only administrative workstations can reach TopicController routes.

bash

# Example NGINX ingress rule restricting the vulnerable endpoint
location = /topic/queryAll {
    allow 10.0.0.0/24;   # administrative subnet
    deny  all;
    proxy_pass http://platform_backend;
}