---
id: CVE-2025-13807
title: >-
  A vulnerability was detected in orionsec orion-ops up to
  5925824997a3109651bbde07460958a7be249ed1
summary: >-
  A vulnerability was detected in orionsec orion-ops up to
  5925824997a3109651bbde07460958a7be249ed1. Affected is the function
  MachineKeyController of the file
  orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyC…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-266
  - CWE-285
vendor: orionsec
product: orion-ops
affected:
  - orion-ops <= 2025-08-01
published: '2025-12-01'
updated: '2026-09-03'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-13807'
references:
  - url: >-
      https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-information-disclosure-1/report.md
    label: cna@vuldb.com
  - url: >-
      https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-information-disclosure-1/report.md#proof-of-concept
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?ctiid.333817'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?id.333817'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/?submit.692066'
    label: cna@vuldb.com
  - url: >-
      https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-information-disclosure-1/report.md
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://github.com/Xzzz111/exps/blob/main/archives/orion-ops-information-disclosure-1/report.md#proof-of-concept
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00364
epssPercentile: 0.27469
ingestedAt: '2026-09-03T03:55:23.139Z'
---

## Overview

A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyController.java of the component API. The manipulation results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `orion-ops <= 2025-08-01`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.