CVE-2025-60914: Openatlas Information Disclosure Flaw

CVE-2025-60914 Overview

CVE-2025-60914 is an incorrect access control vulnerability affecting Austrian Archaeological Institute OpenAtlas versions before v8.12.0. The flaw resides in the /display_logo endpoint, which fails to enforce proper authorization checks. An attacker can send a crafted GET request to this endpoint and retrieve sensitive information without appropriate privileges. The issue is tracked under [CWE-79] in the NVD entry, though the described behavior aligns with broken access control on a resource endpoint. OpenAtlas is a web-based database platform used by researchers to record and manage historical, archaeological, and cultural heritage data.

Critical Impact
Authenticated attackers with low privileges can access sensitive information through the /display_logo endpoint by issuing a crafted GET request, leading to unauthorized data exposure.

Affected Products

Austrian Archaeological Institute OpenAtlas versions prior to v8.12.0
Craws OpenAtlas (cpe:2.3:a:craws:openatlas)
Deployments exposing the /display_logo endpoint over the network

Discovery Timeline

2025-11-24 - CVE-2025-60914 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60914

Vulnerability Analysis

The vulnerability stems from missing authorization enforcement on the /display_logo endpoint in OpenAtlas. The application accepts GET requests to this endpoint and returns data that should be restricted to authorized users. Because the endpoint does not validate the requester's permissions against the resource being served, attackers with minimal application access can retrieve sensitive information. Exploitation requires network access and some level of authenticated interaction, but no elevated privileges. The impact is limited to confidentiality and integrity of the exposed resources, with no direct effect on availability.

Root Cause

The root cause is an improper access control check on a resource-serving endpoint. The /display_logo handler in OpenAtlas versions before v8.12.0 does not verify whether the authenticated user is authorized to view the requested asset. Any user session capable of reaching the endpoint can request arbitrary logo resources, some of which may reference or expose data intended for restricted projects or users.

Attack Vector

An attacker crafts a GET request to the /display_logo endpoint of a vulnerable OpenAtlas instance. The endpoint returns the requested content without validating authorization on the underlying resource. See the SEC4YOU Unauthorized Access Analysis for the full technical write-up, request format, and response behavior documented by the reporting researchers.

No verified public exploit code is currently available. See the SEC4YOU Vulnerabilities Overview for related disclosures.

Detection Methods for CVE-2025-60914

Indicators of Compromise

Unexpected GET requests to the /display_logo endpoint from user accounts that do not typically access branding assets.
Repeated enumeration patterns targeting /display_logo with varying resource identifiers or query parameters.
Anomalous outbound data volumes from OpenAtlas web servers correlating with /display_logo access.

Detection Strategies

Review web server and application logs for /display_logo requests, correlating source IP, user session, and requested resource identifier.
Baseline normal /display_logo request frequency per user and alert on deviations that suggest enumeration.
Compare OpenAtlas version strings in HTTP responses or deployment inventories against v8.12.0 to identify vulnerable instances.

Monitoring Recommendations

Ingest OpenAtlas access logs into a centralized logging platform and retain them long enough to support retrospective investigations.
Enable authentication event logging so that requests to sensitive endpoints can be tied to specific user sessions.
Monitor for user-agent strings and request patterns associated with automated scanners probing /display_logo.

How to Mitigate CVE-2025-60914

Immediate Actions Required

Upgrade all OpenAtlas deployments to version v8.12.0 or later.
Inventory internet-exposed OpenAtlas instances and prioritize patching those reachable from untrusted networks.
Audit historical access logs for /display_logo requests to identify potential prior exposure of sensitive data.

Patch Information

The vulnerability is fixed in Austrian Archaeological Institute OpenAtlas v8.12.0. Administrators should follow the official OpenAtlas upgrade procedure and validate that the /display_logo endpoint enforces authorization after the upgrade. Refer to the SEC4YOU Unauthorized Access Analysis for advisory context.

Workarounds

Restrict network access to OpenAtlas instances to trusted IP ranges using a reverse proxy or firewall until patching is complete.
Block or rate-limit unauthenticated and low-privilege access to /display_logo at the web server or WAF layer.
Review OpenAtlas user roles and remove unnecessary low-privilege accounts that could be leveraged to reach the endpoint.

bash

# Example nginx configuration to restrict /display_logo access by source IP
location /display_logo {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://openatlas_backend;
}