CVE-2025-62169

Published: Oct 23, 2025Modified: Jun 17, 2026Deferred

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks. This issue has been patched in versions 1.8.0a3 of the testing branch and 1.7.8 of the stable branch. The impact of this vulnerability is greatly reduced when using OctoPrint version 1.11.2 and newer.

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

https://github.com/WildRikku/OctoPrint-SpoolManager/commit/b725e113316e177ce81238a2dbbbdb63d92c40b0

Source: security-advisories@github.com

https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.7.8

Source: security-advisories@github.com

https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.8.0a3

Source: security-advisories@github.com

https://github.com/WildRikku/OctoPrint-SpoolManager/security/advisories/GHSA-2rrc-f24f-94f6

Source: security-advisories@github.com

Timeline

No history available yet.