CVE-2025-62189: Logstare Collector Auth Bypass Vulnerability

CVE-2025-62189 Overview

CVE-2025-62189 is an incorrect authorization vulnerability [CWE-863] in the UserRegistration component of LogStare Collector by Secuavail. The flaw allows an authenticated, non-administrative user to create new user accounts by sending a crafted HTTP request. Because account creation is normally reserved for administrators, this defect breaks the product's role-based access control model and enables unauthorized identity provisioning.

The vulnerability requires low privileges and is reachable over the network without user interaction. LogStare Collector runs on both Linux and Windows hosts, so any deployment across supported operating systems is affected.

Critical Impact
A low-privileged authenticated user can register arbitrary accounts in LogStare Collector, undermining administrative controls and enabling persistence for follow-on attacks against the log collection infrastructure.

Affected Products

Secuavail LogStare Collector (versions listed in the Logstare Vulnerability Report 2025-001)
Linux Kernel-based deployments of LogStare Collector
Microsoft Windows deployments of LogStare Collector

Discovery Timeline

2025-11-21 - CVE-2025-62189 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-62189

Vulnerability Analysis

LogStare Collector exposes a UserRegistration endpoint intended for administrator use. The endpoint fails to properly verify the requesting user's role before performing the account creation operation. As a result, a user holding only standard privileges can submit an HTTP request that creates a new user account.

The defect is a classic authorization enforcement gap. Authentication succeeds and the request reaches business logic, but the server never checks whether the authenticated principal holds the administrator role required for user provisioning. The impact is limited to integrity because the flaw enables unauthorized modification of the user database. Confidentiality and availability are not directly affected by the primitive itself, though newly created accounts can be leveraged for follow-on activity.

Root Cause

The root cause is missing or incomplete role validation in the UserRegistration request handler. LogStare Collector treats a valid session as sufficient authority to register new users. Per CWE-863: Incorrect Authorization, the application performs an authorization check but reaches an incorrect decision, allowing an action that should be denied.

Attack Vector

An attacker authenticates to LogStare Collector using any valid non-administrative account, including a low-tier operator or read-only user. The attacker then sends a crafted HTTP request to the UserRegistration handler with parameters describing the target account. The server creates the account without rejecting the request for insufficient privileges. The attacker can now log in as the newly created user and, depending on the assigned role, further manipulate the collector configuration or logs.

No public proof-of-concept or exploit is available at time of publication. Refer to the JVN Security Advisory JVN77560819 for vendor-confirmed technical details.

Detection Methods for CVE-2025-62189

Indicators of Compromise

Unexpected user accounts appearing in the LogStare Collector user database that were not provisioned by an administrator.
HTTP requests to the UserRegistration endpoint originating from sessions belonging to non-administrative users.
Audit log entries showing account creation actions attributed to standard users rather than administrators.

Detection Strategies

Correlate authentication logs with account creation events to flag registrations performed by sessions that lack administrator role assignments.
Baseline normal user provisioning frequency and alert on deviations, especially registrations occurring outside change-management windows.
Inspect web server or application logs for POST requests targeting the UserRegistration path from unexpected source addresses or user agents.

Monitoring Recommendations

Forward LogStare Collector application logs and web access logs to a centralized SIEM for continuous review.
Enable alerting on any modification to the user table, including new account creation, role changes, and password resets.
Track and review administrator role assignments on a recurring schedule to detect unauthorized elevation.

How to Mitigate CVE-2025-62189

Immediate Actions Required

Apply the vendor-supplied update referenced in the Logstare Vulnerability Report 2025-001 as soon as it is available for your deployment.
Audit the LogStare Collector user database and remove any accounts that cannot be tied to an approved provisioning request.
Rotate credentials for all existing non-administrative accounts to invalidate any sessions that may have been abused.
Restrict network access to the LogStare Collector management interface to trusted administrative networks only.

Patch Information

Secuavail has published fix information in the Logstare Vulnerability Report 2025-001. Administrators should follow the vendor guidance to obtain and install the fixed version on both Linux and Windows deployments. Coordinated disclosure details are available through JVN77560819.

Workarounds

Limit LogStare Collector user accounts to the minimum set required for operations until the patch is applied.
Place the LogStare Collector web interface behind a reverse proxy or firewall that restricts access to administrator source addresses.
Enable enhanced logging on the UserRegistration endpoint and review activity daily until the update is deployed.

bash

# Example: restrict access to the LogStare Collector management interface
# using iptables on Linux hosts (adjust ADMIN_NET to your admin CIDR)
ADMIN_NET="10.10.0.0/24"
iptables -A INPUT -p tcp --dport 443 -s ${ADMIN_NET} -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP