CVE detail
CVE-2025-14025
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. However, this vulnerability allows read-only tokens to perform write operations on backend services (e.g., Controller, Hub, EDA). If this flaw were exploited, an attacker‘s capabilities would only be limited by role based access controls (RBAC).
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 20.8 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
7 source links · newest first
- https://bugzilla.redhat.com/show_bug.cgi?id=2418785bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comJan 8, 2026, 2:15 PM - https://access.redhat.com/security/cve/CVE-2025-14025access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJan 8, 2026, 2:15 PM - https://access.redhat.com/errata/RHSA-2026:0409access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJan 8, 2026, 2:15 PM - https://access.redhat.com/errata/RHSA-2026:0408access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJan 8, 2026, 2:15 PM - https://access.redhat.com/errata/RHSA-2026:0361access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJan 8, 2026, 2:15 PM - https://access.redhat.com/errata/RHSA-2026:0360access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJan 8, 2026, 2:15 PM - https://access.redhat.com/articles/7136004access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comJan 8, 2026, 2:15 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-46388CVSS 4.4 · Medium
osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Prior to 5.23.1, an unprivileged attacker can read the contents of an osquery file…
- CVE-2026-4948CVSS 5.5 · Medium
A flaw was found in firewalld. A local unprivileged user can exploit this vulnerability by mis-authorizing two runtime D-Bus (Desktop Bus) setters, setZoneSettings2 and setPolicyS…
- CVE-2026-20062CVSS 7.2 · High
A vulnerability in the CLI of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software in multiple context mode could allow an authenticated, local attacker with administr…
- CVE-2025-12801CVSS 6.5 · Medium
A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the privileges assigned to it in the /e…
- CVE-2025-36228CVSS 3.8 · Low
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, p…
- CVE-2025-13663CVSS 5.4 · Medium
Under certain circumstances, the Quartus Prime Pro Installer for Windows does not check the permissions of the Quartus target installation directory if the target installation dir…