CVE-2025-13084: groov View API Info Disclosure Flaw

CVE-2025-13084 Overview

CVE-2025-13084 affects the Opto 22 groov View API, where the users endpoint returns a list of all users along with associated metadata, including their API keys. The endpoint requires only an Editor role to access, yet it exposes API keys belonging to all users, including Administrators. An authenticated low-privilege user can retrieve credentials that enable horizontal and vertical privilege escalation across the industrial control system interface. The flaw is categorized under CWE-1230: Exposure of Sensitive Information Through Metadata and was disclosed through a CISA ICS Advisory.

Critical Impact
An Editor-level account can harvest Administrator API keys through a single API call, enabling full takeover of the groov View environment.

Affected Products

Opto 22 groov View (per the CISA ICS Advisory ICSA-25-329-04)
groov View API users endpoint
Deployments where multiple roles share the same groov View instance

Discovery Timeline

2025-11-26 - CVE-2025-13084 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13084

Vulnerability Analysis

The groov View API exposes a users endpoint that returns user metadata for administrative purposes. The endpoint includes each user's API key in the response body. Access control on the endpoint requires only the Editor role, which is intended for content authoring, not user administration. The result is a privilege boundary violation: an Editor can read secrets that belong to Administrators.

API keys in groov View grant programmatic access tied to the owning user's role. Retrieving an Administrator key allows an attacker to call any Administrator-restricted API as that user, bypassing the role separation enforced elsewhere in the product. The vulnerability does not require memory corruption, injection, or chained exploitation. The exposure occurs by design in the response payload.

Root Cause

The root cause is improper separation of sensitive metadata from general user metadata in the API response. The endpoint applies a single role check (Editor) for the entire payload rather than redacting credential fields based on the requester's privilege relative to each target user. This matches the CWE-1230 pattern of leaking sensitive data through metadata fields that should be access-controlled independently.

Attack Vector

An authenticated user with Editor privileges issues an HTTP GET request to the groov View API users endpoint over the network. The response returns every user record, including the apiKey field for Administrator accounts. The attacker then reuses any harvested Administrator API key to authenticate subsequent API requests, gaining full control of groov View configuration, tags, and connected industrial assets.

The vulnerability mechanism is described in prose only because no verified proof-of-concept code is published. Refer to the Opto 22 Knowledge Base Article KB91325 for vendor technical detail.

Detection Methods for CVE-2025-13084

Indicators of Compromise

Editor-role accounts making GET requests to the groov View API users endpoint, particularly outside scheduled administrative activity.
API authentication events using Administrator keys from source IPs or user agents previously associated only with Editor sessions.
Configuration changes in groov View performed via API immediately after a users endpoint query by a non-Administrator account.

Detection Strategies

Enable verbose API access logging on groov View and forward logs to a centralized analytics platform for correlation.
Build a detection that flags any access to the users endpoint by accounts that are not designated for user administration.
Correlate Editor-account users endpoint reads with subsequent Administrator API key usage within a short time window.

Monitoring Recommendations

Inventory all groov View Editor accounts and review whether each one still requires that role.
Monitor network traffic between operator workstations and groov View controllers for anomalous API call volume.
Audit API key issuance and rotation history to detect unauthorized reuse of Administrator keys.

How to Mitigate CVE-2025-13084

Immediate Actions Required

Apply the vendor remediation referenced in the Opto 22 Knowledge Base Article KB91325 as soon as it is available for your deployment.
Rotate all groov View API keys, prioritizing Administrator accounts, and invalidate any previously issued keys.
Reduce the number of Editor-role accounts and remove Editor access from users who only need View or operator privileges.
Restrict groov View management interfaces to isolated control networks and require VPN or jump host access from corporate environments.

Patch Information

Opto 22 documents the remediation guidance in KB91325. The CISA ICS Advisory ICSA-25-329-04 and the corresponding CSAF JSON file list the affected versions and recommended fixed releases. Operators should apply the vendor-supplied update according to the change management procedures used for their industrial control environment.

Workarounds

Remove the Editor role from any account that does not strictly require write access to groov View pages.
Place groov View behind a network segmentation boundary that allows API traffic only from known administrative hosts.
Disable API key authentication for Administrator accounts where alternative authentication methods are supported, and use short-lived credentials elsewhere.

bash

# Example: rotate a groov View API key after applying the vendor update
# 1. Sign in to groov View as Administrator
# 2. Navigate to: Configure > Users
# 3. For each user, regenerate the API key and update any
#    integrations or scripts that consume the previous key
# 4. Confirm old keys are rejected by issuing a test request:
curl -k -H "apiKey: <OLD_KEY>" https://<groov-host>/view/api/v0/users
# Expected: HTTP 401 Unauthorized