CVE-2025-22138: QPixel Information Disclosure Vulnerability

CVE-2025-22138 Overview

QPixel is a Q&A-based community knowledge-sharing platform maintained by Codidact. CVE-2025-22138 describes an information disclosure flaw in how QPixel enforces category visibility. When an administrator marks a category as private or limited-visibility, suggested edits submitted within that category remain reachable through the suggested edit queue. Unprivileged users and anonymous visitors can read content that the category restrictions were expected to hide. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. At the time of publication, no patch or workaround is available from the maintainers.

Critical Impact
Anonymous and unprivileged users can view suggested edits from restricted categories through the suggested edit queue, bypassing category visibility controls.

Affected Products

@codidact/qpixel Q&A community knowledge-sharing software
Deployments with categories configured as private or limited-visibility
All currently released versions (no fixed version published)

Discovery Timeline

2025-01-13 - CVE-2025-22138 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-22138

Vulnerability Analysis

QPixel supports category-level access controls that let administrators restrict content to specific user groups. The suggested edit workflow queues user-submitted revisions for reviewer approval before they are merged into a post. The advisory states that access checks on the suggested edit queue do not honor the visibility settings of the parent category. As a result, edit proposals containing text from a private category surface to unauthenticated viewers and to users without membership in the restricted group.

This is a broken access control issue rather than a code execution flaw. The confidentiality impact is limited to content exposed through suggested edits, but that content can include the original post text embedded in the diff.

Root Cause

The root cause is a missing authorization check on the suggested edit queue endpoint. The queue enumerates pending edits across all categories without cross-referencing category-level visibility permissions. Category ACLs are enforced at the post-view layer but not at the edit-queue layer, producing an inconsistent authorization model.

Attack Vector

Exploitation requires no authentication and no elevated privileges. An attacker browses the public suggested edit queue in a QPixel instance and reads edits that reference posts in private or limited-visibility categories. See the GitHub Security Advisory GHSA-pv74-hcg9-65r4 for the maintainer's technical description.

Because no exploit code is required, the maintainers explicitly advise that private categories must not be treated as a mechanism for storing sensitive information until a fix is released.

Detection Methods for CVE-2025-22138

Indicators of Compromise

Web server access logs showing anonymous or low-privilege sessions repeatedly requesting the suggested edit queue endpoint.
Unusually high enumeration of paginated suggested-edit URLs from a single client.
Referrer chains where users reach restricted category content through the edit queue rather than the category page.

Detection Strategies

Compare authenticated user roles against the categories represented in edit-queue view requests to identify authorization mismatches.
Alert on any unauthenticated request that returns 200 for suggested-edit content tied to a category flagged as private in the QPixel admin database.
Correlate access to the suggested edit queue with subsequent lateral browsing of restricted post IDs.

Monitoring Recommendations

Enable verbose request logging on the QPixel Rails application, capturing route, user ID, and category ID for all edit-queue traffic.
Forward web and application logs to a centralized analytics platform for anomaly detection on edit-queue access patterns.
Review admin audit logs for recent changes to category visibility to identify content that may already be exposed.

How to Mitigate CVE-2025-22138

Immediate Actions Required

Assume that any content posted in a private or limited-visibility category is publicly readable and remove sensitive material from those categories.
Notify community members and moderators that private category confidentiality cannot currently be enforced.
Monitor the codidact/qpixel GitHub repository for security releases addressing this advisory.

Patch Information

No patch is available at the time of publication. The maintainers direct operators to follow the development repository for updates and reference the internal tracking ticket SUPPORT-114 for status. Apply the fix as soon as an upstream release referencing GHSA-pv74-hcg9-65r4 is published.

Workarounds

No official workaround is available from the maintainers.
Operators who require stronger separation can host sensitive content on a separate QPixel instance restricted at the network or reverse-proxy layer.
Consider temporarily disabling the suggested edit feature at the application or reverse-proxy layer if the risk outweighs collaboration needs.

bash

# Example reverse-proxy rule to block anonymous access to the suggested edit queue
# Adjust the location path to match your QPixel deployment
location /suggested-edits {
    auth_request /auth;
    proxy_pass http://qpixel_upstream;
}