CVE-2025-26376 Overview
CVE-2025-26376 is a Missing Authorization vulnerability [CWE-862] in the maxprofile/users/routes.lua component of Q-Free MaxTime traffic management software. The flaw affects all versions up to and including 2.11.0. An authenticated attacker with low privileges can send crafted HTTP requests to modify user data belonging to other accounts, including higher-privileged users. The vulnerability was disclosed through a Nozomi Networks Vulnerability Advisory and published to the National Vulnerability Database on February 12, 2025.
Critical Impact
A low-privileged authenticated user can alter arbitrary user records, enabling account takeover and privilege escalation within MaxTime deployments used to manage traffic signal infrastructure.
Affected Products
- Q-Free MaxTime versions <= 2.11.0
- The vulnerable component: maxprofile/users/routes.lua
- Deployments exposing the MaxTime web interface to authenticated users
Discovery Timeline
- 2025-02-12 - CVE-2025-26376 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26376
Vulnerability Analysis
The vulnerability resides in the user management routes handled by maxprofile/users/routes.lua within the Q-Free MaxTime application. The route handlers responsible for modifying user profile data authenticate the requesting session but fail to verify whether the authenticated principal is authorized to modify the target user record. As a result, any logged-in account, including the lowest-privilege operator role, can issue HTTP requests that mutate other users' attributes. Attackers can leverage this to escalate privileges by altering role assignments, resetting credentials, or changing contact information used for account recovery.
MaxTime is deployed in Advanced Traffic Management System (ATMS) environments that control real-world traffic signal infrastructure. Compromise of an administrative account can expose control interfaces used to configure traffic controllers. Refer to the Nozomi Networks Vulnerability Advisory for additional technical context.
Root Cause
The root cause is a missing authorization check within the Lua route handlers under maxprofile/users/routes.lua. The code enforces authentication but omits a permission check comparing the acting user's role and identity against the target user identifier supplied in the request. This is a textbook [CWE-862] Missing Authorization defect where authentication is conflated with authorization.
Attack Vector
Exploitation requires network access to the MaxTime web application and valid credentials for a low-privileged account. The attacker crafts an HTTP request targeting a user modification endpoint and substitutes the identifier of a higher-privileged user. Because the server does not validate the caller's permission to act on the target record, the modification succeeds. No user interaction is required beyond the attacker's own request.
No public proof-of-concept exploit code is available for this vulnerability. See the vendor advisory for further technical details.
Detection Methods for CVE-2025-26376
Indicators of Compromise
- Unexpected changes to user role, email, or password fields in the MaxTime user database not attributable to an administrator session.
- HTTP requests to user profile endpoints where the acting session's user ID does not match the target user ID.
- New or elevated administrator accounts created outside of documented change windows.
Detection Strategies
- Enable verbose access logging on the MaxTime web server and forward logs to a centralized SIEM for correlation.
- Build detections that flag PUT, POST, or PATCH requests to maxprofile/users routes where the session principal differs from the target user object.
- Alert on privilege modifications performed by accounts that do not hold administrator roles.
Monitoring Recommendations
- Monitor authentication and account modification events for anomalies against a baseline of normal administrator activity.
- Track failed and successful login attempts following any user record modification to identify chained account takeover.
- Review audit trails for the MaxTime application on a scheduled basis and after any suspected incident.
How to Mitigate CVE-2025-26376
Immediate Actions Required
- Restrict network access to the MaxTime web interface to trusted management networks and administrative jump hosts.
- Audit existing MaxTime user accounts, remove unused credentials, and rotate passwords for all administrator accounts.
- Review recent user modification events to identify unauthorized changes prior to remediation.
Patch Information
Upgrade Q-Free MaxTime to a version above 2.11.0 that includes the vendor's fix for the missing authorization check. Consult the Nozomi Networks Vulnerability Advisory and Q-Free support for the fixed release version applicable to your deployment.
Workarounds
- Place the MaxTime application behind a reverse proxy or web application firewall that enforces role-based access controls at the request level.
- Limit issuance of MaxTime accounts and grant only the minimum privileges required for each operator.
- Segment MaxTime servers from general enterprise networks to reduce the pool of accounts that could be misused for exploitation.
# Example: restrict MaxTime access to a management subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.