CVE-2025-11580: PowerJob has Missing Authorization in its /user/list file

October 10, 2025 (updated February 25, 2026)

A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

References

github.com/PowerJob/PowerJob
github.com/PowerJob/PowerJob/issues/1127
github.com/advisories/GHSA-87xj-ghmc-c3xq
nvd.nist.gov/vuln/detail/CVE-2025-11580
vuldb.com/?ctiid.327902
vuldb.com/?id.327902
vuldb.com/?submit.662446

Code Behaviors & Features

Detect and mitigate CVE-2025-11580 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →