CVE-2025-57817

HIGH8.6

Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation

Published Sep 8, 2025

Modified 1 years ago

Details

Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with client:create or client:update permissions to escalate their privileges to owner-level. Version 2.69.1 fixes the issue. No known workarounds are available.

References

WEB

https://github.com/ethyca/fides/commit/2ffd125e1089a09b84c27fb5279a05960cbf2452

WEB

https://github.com/ethyca/fides/releases/tag/2.69.1

WEB

https://github.com/ethyca/fides/security/advisories/GHSA-hjfh-p8f5-24wr

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-57817

CVSS Analysis

CVSS v4.0

8.6