CVE-2025-15235: Quantatw Qoca Aim Auth Bypass Vulnerability

CVE-2025-15235 Overview

CVE-2025-15235 is a Missing Authorization vulnerability [CWE-862] in the QOCA aim AI Medical Cloud Platform developed by Quanta Computer. Authenticated remote attackers can modify specific network packet parameters to make certain system functions access files belonging to other users. The flaw enables cross-tenant data access without exploiting memory corruption or authentication weaknesses. Because QOCA aim is deployed in medical environments, the exposed files may contain protected health information. The Exploit Prediction Scoring System (EPSS) currently places exploitation probability at 0.295%.

Critical Impact
Authenticated users can retrieve other users' files by tampering with request parameters, breaking tenant isolation in a medical cloud platform.

Affected Products

Quanta Computer QOCA aim AI Medical Cloud Platform
quantatw:qoca_aim (all versions prior to the vendor fix)

Discovery Timeline

2026-01-05 - CVE-2025-15235 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-15235

Vulnerability Analysis

The vulnerability is a server-side authorization gap in QOCA aim's request handling. Certain backend functions accept user-supplied identifiers (for example, file, record, or resource IDs) without validating that the authenticated caller owns the referenced object. An attacker who holds any valid account can substitute another user's identifier and receive the target file in the response.

This pattern is classified as Missing Authorization [CWE-862] and commonly overlaps with Insecure Direct Object Reference (IDOR) behavior. Confidentiality impact is high because file contents belonging to other users are returned. Integrity and availability are not directly affected by this issue.

Root Cause

The root cause is the absence of an ownership or role check between authentication and resource retrieval. QOCA aim authenticates the session but does not re-verify that the requested resource belongs to the calling principal. Authorization is implicitly assumed from parameter values controlled by the client rather than enforced server-side against a trusted access-control model.

Attack Vector

Exploitation requires network access to the application and valid low-privilege credentials. No user interaction is needed. An attacker intercepts a legitimate request with a proxy, changes the identifier of a file or resource parameter, and reissues the request. The server processes the modified parameter and returns the targeted file. Enumeration of sequential or predictable identifiers allows bulk retrieval of other tenants' data.

No public proof-of-concept code has been published. See the TWCert Security Advisory 10616 for vendor-confirmed technical details.

Detection Methods for CVE-2025-15235

Indicators of Compromise

Application or web-server logs showing a single authenticated session accessing files or records associated with many distinct user or tenant identifiers.
Sequential or scripted access patterns to file-retrieval endpoints, especially with iterating numeric or UUID parameters.
Unusual data-egress volumes from QOCA aim service accounts that historically access only a limited dataset.

Detection Strategies

Correlate authenticated user identity with the owner attribute of every returned resource at the application layer; flag mismatches.
Baseline per-user file access rates on QOCA aim endpoints and alert when a session exceeds the baseline by a defined threshold.
Deploy web application firewall rules that inspect object identifier parameters for enumeration patterns and repeated 200-status responses across different IDs.

Monitoring Recommendations

Forward QOCA aim application, authentication, and reverse-proxy logs to a centralized analytics platform for cross-session correlation.
Enable full request and response metadata logging for file-access endpoints, including caller identity, requested resource ID, and resource owner.
Monitor outbound traffic from application servers for atypical download volumes tied to individual authenticated sessions.

How to Mitigate CVE-2025-15235

Immediate Actions Required

Apply the fixed QOCA aim release from Quanta Computer as referenced in the TWCert Security Advisory 10615.
Audit application and access logs since deployment for cross-user file access patterns consistent with this vulnerability.
Rotate credentials for any accounts that show suspicious enumeration behavior and notify affected data subjects if unauthorized access is confirmed.

Patch Information

Quanta Computer has issued a security update for QOCA aim addressing the Missing Authorization flaw. Refer to the vendor and TWCert advisories for the fixed build identifiers and upgrade procedure: TWCert Security Advisory 10616 and TWCert Security Advisory 10615.

Workarounds

Restrict QOCA aim access to trusted network segments and enforce strong authentication and session controls until the patch is deployed.
Implement a reverse-proxy or API gateway policy that rewrites or validates resource identifier parameters against the authenticated session.
Reduce the number of active accounts and apply least-privilege role assignments to shrink the pool of potential attackers.

bash

# Example reverse-proxy rule to log and inspect object-ID parameters
# (adapt path and parameter names to your QOCA aim deployment)
location /api/files/ {
    # Log caller identity and requested resource for post-hoc authorization audit
    access_log /var/log/nginx/qoca_files_audit.log combined;
    proxy_set_header X-Authenticated-User $remote_user;
    proxy_pass http://qoca_backend;
}