---
id: CVE-2025-34467
title: "ZwiiCMS\_versions prior to\_13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined with flawed resource state management"
summary: "ZwiiCMS\_versions prior to\_13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined with flawed resource state management. When an authenticated low-privilege use…"
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-667
  - CWE-863
vendor: zwiicms
product: zwiicms
affected:
  - zwiicms < 13.7.00
patched:
  - zwiicms 13.7.00
published: '2025-12-31'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T14:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-34467'
references:
  - url: 'https://codeberg.org/fredtempez/ZwiiCMS/releases/tag/13.7.00'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/fredtempez/ZwiiCMS'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/zwiicms-lock-persistence-authenticated-dos-against-administrative-pages
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00218
epssPercentile: 0.10863
ingestedAt: '2026-07-15T13:44:03.645Z'
---

## Overview

ZwiiCMS versions prior to 13.7.00 contain a denial-of-service vulnerability in multiple administrative endpoints due to improper authorization checks combined with flawed resource state management. When an authenticated low-privilege user requests an administrative page, the application returns "404 Not Found" as expected, but incorrectly acquires and associates a temporary lock on the targeted resource with the attacker session prior to authorization. This lock prevents other users, including administrators, from accessing the affected functionality until the attacker navigates away or the session is terminated.

## Affected

- `zwiicms < 13.7.00`

## Remediation

Upgrade past the affected range:

- `zwiicms 13.7.00`