{"id":"CVE-2025-13828","title":"SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.\n\nImpactA low-privileged user of the pla…","summary":"SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.\n\nImpactA low-privileged user of the pla…","severity":"none","cwe":["CWE-862"],"published":"2025-12-02","updated":"2026-09-03","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-13828","references":[{"url":"https://github.com/mautic/mautic/security/advisories/GHSA-3fq7-c5m8-g86x","label":"security@mautic.org"}],"tags":["nvd"],"epss":0.00246,"epssPercentile":0.16156,"ingestedAt":"2026-09-03T03:55:24.073Z","slug":"CVE-2025-13828","body":"## Overview\n\nSummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked.\n\nImpactA low-privileged user of the platform can install malicious code to obtain higher privileges.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}