Therefore™ Online and Therefore™ On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored data_CVE-2025-11843

{
    "lastseen": "",
    "description": "Therefore Corporation GmbH has recently become aware that Therefore\u2122 Online and Therefore\u2122 On-Premises contain an account impersonation vulnerability. A malicious user may potentially be able to impersonate the web service account or the account of a service using the API when connecting to the Therefore\u2122 Server. If the malicious user gains this impersonation user access, then it is possible for them to access the documents stored in Therefore\u2122. This impersonation is at application level (Therefore access level), not the operating system level.",
    "published": "2025-10-31T09:43:08.597Z",
    "modified": "2025-10-31T18:52:36.823Z",
    "type": "cve",
    "title": "Therefore\u2122 Online and Therefore\u2122 On-Premises contains an account impersonation issue, which could potentially allow the attacker to access all the stored data",
    "source": "Canon_EMEA",
    "references": "https://www.canon-europe.com/psirt/advisory-information/",
    "id": "CVE-2025-11843",
    "bulletinFamily": "",
    "cwe": [
        "CWE-290"
    ],
    "cvelist": null,
    "sourceData": "Therefore Corporation GmbH Therefore Online and Therefore On-Premises 0",
    "sourceHref": "",
    "cvss": {
        "score": 8.8,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Therefore Online and Therefore On-Premises",
    "version": "0",
    "vendor": "Therefore Corporation GmbH",
    "ai_description": "Account impersonation vulnerability in Therefore Online and Therefore On-Premises, allowing access to stored documents",
    "ai_severity": "High",
    "ai_vendor": "Therefore Corporation GmbH",
    "ai_product": "Therefore Online and Therefore On-Premises",
    "ai_version": "0",
    "ai_score": 8.8
}