CVE Details
Basic Information
| Title | ETQ Reliance CG/NXG API Authorization Bypass via ;localized-text URI Suffix |
|---|---|
| Type | cve |
| Published | 2025-07-22T12:34:31.324Z |
| Modified | 2025-07-22T13:24:24.675Z |
Product Information
| Vendor | ETQ |
|---|---|
| Product | Reliance CG (legacy) |
| Version | * |
CVSS Information
| Base Score | 8.7 (HIGH) |
|---|---|
| Attack Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Affected Products
- ETQ Reliance CG (legacy) *
- ETQ Reliance NXG (SaaS) *
- ETQ Reliance NXG (SaaS) *
Additional Information
| CWE List | CWE-639 |
|---|---|
| Source | VulnCheck |
Description
An authorization bypass vulnerability exists in ETQ Reliance (legacy CG and NXG SaaS platforms). By appending a specific URI suffix to certain API endpoints, an unauthenticated attacker can bypass access control checks and retrieve limited sensitive resources. The root cause was a misconfiguration in API authorization logic, which has since been corrected in SE.2025.1 and 2025.1.2.