---
id: CVE-2025-61075
title: >-
  Multiple Incorrect Access Control vulnerabilities in adata Software GmbH
  Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileged users to
  carry out administrative functions and manipulate data of other users via
  unauthorize…
summary: >-
  Multiple Incorrect Access Control vulnerabilities in adata Software GmbH
  Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileged users to
  carry out administrative functions and manipulate data of other users via
  unauthorize…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-639
vendor: adata
product: mitarbeiter_portal
affected:
  - mitarbeiter_portal < 2.16.1
patched:
  - mitarbeiter_portal 2.16.1
published: '2025-12-09'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T19:10:00.173'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61075'
references:
  - url: 'https://no-sec.net/posts/cve-2025-61075/'
    label: cve@mitre.org
  - url: 'https://www.adata.de/mitarbeiter-portal/'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.0054
epssPercentile: 0.44041
ingestedAt: '2026-10-15T19:25:46.340Z'
---

## Overview

Multiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileged users to carry out administrative functions and manipulate data of other users via unauthorized API calls.

## Affected

- `mitarbeiter_portal < 2.16.1`

## Remediation

Upgrade past the affected range:

- `mitarbeiter_portal 2.16.1`