Multiple vulnerabilities in Viafirma products
- Viafirma Inbox, versions prior to 4.5.27;
- Viafirma Documents, versions prior to 3.7.139;
- Viafirma Documents Compose, versions prior to 1.9.2.
INCIBE has coordinated the publication of two vulnerabilities, both high severity, affecting Documents, Documents Compose, and Inbox from Viafirma, a platform for electronic signature management. The vulnerabilities were discovered by Carlos Aguadé Cabañas.
These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type for each vulnerability:
- CVE-2025-41077: CVSS v4.0: 8.6 | CVSS AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | CWE-639
- CVE-2025-41078: CVSS v4.0: 8.7 | CVSS AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N | CWE-863
The vulnerabilities have been fixed by the Viafirma team.
- The vulnerability CVE-2025-41077 has been fixed in Viafirma Inbox v4.5.27.
- The vulnerability CVE-2025-41078 has been fixed in Viafirma Documents v3.7.139 and in Viafirma Documents Compose v1.9.2.
CVE-2025-41077: IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access and modify their data. This allows the user's email addresses to be modified and, subsequently, using the password recovery functionality to access the application by impersonating any user, including those with administrative permissions.
CVE-2025-41078: weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modification, and deletion features, and escalate privileges by impersonating other users of the application in the generation and signing of documents.
