Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.5

Unauthorized access to sensitive vehicle data through vehicleId

CVE-2025-11690 · published 1 year ago
Summary

An attacker can access GPS coordinates, encryption keys, and other sensitive information of other users' vehicles by manipulating the vehicleId parameter. This is a serious security issue that affects all users, so we recommend that the software developers take immediate action to fix the problem and limit access to authorized users only.

Original advisory text
An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue ena...
An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own vehicle data. The fix for this vulnerability is a server-side authorization fix.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published4 Nov 2025
Updated26 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-11690 · NVD
Track software like this
Free during beta