CVE-2025-26372 Overview
CVE-2025-26372 is a Missing Authorization vulnerability [CWE-862] in Q-Free MaxTime traffic management software. The flaw resides in the maxprofile/user-groups/routes.lua route handler in versions less than or equal to 2.11.0. An authenticated low-privileged attacker can send crafted HTTP requests to remove users from groups without proper authorization checks. This breaks access control boundaries inside the application and allows lateral manipulation of group membership.
Critical Impact
A low-privileged authenticated attacker can manipulate user-group membership over the network, undermining the integrity and availability of identity and access controls within Q-Free MaxTime deployments.
Affected Products
- Q-Free MaxTime versions <= 2.11.0
- The maxprofile/user-groups/routes.lua route handler
- Deployments exposing the MaxTime management interface to authenticated users
Discovery Timeline
- 2025-02-12 - CVE-2025-26372 published to NVD
- 2025-03-03 - Last updated in NVD database
Technical Details for CVE-2025-26372
Vulnerability Analysis
The vulnerability is a Missing Authorization weakness in the user-groups route handler of Q-Free MaxTime. The application authenticates requests but fails to verify that the caller holds the privileges required to modify group membership. As a result, any user holding a valid session, including low-privileged accounts, can issue HTTP requests that remove other users from groups.
The consequence is direct manipulation of access control state. Removing users from privileged or operational groups can revoke their permissions, disrupt workflow continuity, and enable an attacker to isolate accounts that would normally have oversight. The flaw affects integrity and availability of the access control model while leaving confidentiality of stored data intact.
Root Cause
The root cause is the absence of an authorization check in maxprofile/user-groups/routes.lua. The handler validates the session but does not enforce role-based or permission-based gating before executing the group modification operation. This pattern is characteristic of [CWE-862] Missing Authorization, where authentication is treated as sufficient evidence of intent and privilege.
Attack Vector
The attack is performed remotely over the network by an authenticated attacker. The attacker only needs a valid low-privileged account and direct HTTP access to the MaxTime web interface. No user interaction is required. The attacker crafts an HTTP request targeting the vulnerable route and supplies parameters that identify the target user and group, causing the server to remove the membership association.
No verified public exploit or proof-of-concept code is available at this time. Technical details are described in the Nozomi Networks Vulnerability Advisory.
Detection Methods for CVE-2025-26372
Indicators of Compromise
- Unexpected HTTP requests from low-privileged sessions to endpoints served by maxprofile/user-groups/routes.lua.
- Audit log entries showing group membership removals performed by accounts that do not normally administer users.
- Sudden loss of group-based permissions for administrative or operational accounts without a corresponding change ticket.
Detection Strategies
- Enable verbose application logging on MaxTime and alert on any group modification action whose actor lacks an administrative role.
- Correlate web access logs with application audit logs to surface group membership changes initiated outside expected administrative workflows.
- Baseline normal user-group modification patterns and flag deviations such as bulk removals or off-hours activity.
Monitoring Recommendations
- Forward MaxTime application and web server logs to a centralized logging or SIEM platform for long-term retention and correlation.
- Monitor authentication events from low-privileged accounts that immediately precede privileged API calls.
- Track HTTP request rates against maxprofile/user-groups/* endpoints and alert on unusual spikes.
How to Mitigate CVE-2025-26372
Immediate Actions Required
- Inventory all Q-Free MaxTime instances and confirm the running version against the <= 2.11.0 affected range.
- Restrict network access to the MaxTime management interface so it is only reachable from trusted administrative networks.
- Review existing user accounts, disable unused low-privileged accounts, and rotate credentials where exposure is suspected.
- Audit recent group membership changes and restore any unauthorized removals.
Patch Information
No vendor advisory URL is listed in the NVD entry at the time of writing. Operators should consult Q-Free directly for a fixed release beyond version 2.11.0 and review the Nozomi Networks Vulnerability Advisory for the most current remediation guidance.
Workarounds
- Place the MaxTime management interface behind a VPN or reverse proxy that enforces additional authentication and source-IP restrictions.
- Apply the principle of least privilege by reducing the number of accounts that can authenticate to the MaxTime application.
- Implement compensating monitoring that alerts on any call to user-group modification endpoints until a patched version is deployed.
# Example: restrict access to the MaxTime management interface at the network edge
# Allow only the administrative subnet to reach the application port
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
