Identity CVE · Secrets managers
CVE-2025-49829CyberArk Conjur missing validations, permission bypass
medium · CVSS 6.0
What broke
Conjur did not validate a resource identifier tightly enough. An authenticated (or, in the chain, forged) caller could inject a resource and skip a permission check. CVSS 6.0. Fixed in the same 1.22.1 / 13.6.1 train.
Why it matters
A "medium" authorization bug is how a forged machine identity from CVE-2025-49827 becomes a policy write, which becomes template injection. Score the chain, not the CWE in isolation.
What to do
- Upgrade with the rest of the Cyata set.
- Review Conjur policy for unexpected resource IDs created in mid-2025 if the authenticator was internet-reachable.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.