---
id: CVE-2025-62169
title: >-
  OctoPrint-SpoolManager is a plugin for managing spools and all their usage
  metadata
summary: >-
  OctoPrint-SpoolManager is a plugin for managing spools and all their usage
  metadata. In versions 1.8.0a2 and older of the testing branch and versions
  1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager
  plugin do …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-287
published: '2025-10-23'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T11:10:00.250'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62169'
references:
  - url: >-
      https://github.com/WildRikku/OctoPrint-SpoolManager/commit/b725e113316e177ce81238a2dbbbdb63d92c40b0
    label: security-advisories@github.com
  - url: 'https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.7.8'
    label: security-advisories@github.com
  - url: 'https://github.com/WildRikku/OctoPrint-SpoolManager/releases/tag/1.8.0a3'
    label: security-advisories@github.com
  - url: >-
      https://github.com/WildRikku/OctoPrint-SpoolManager/security/advisories/GHSA-2rrc-f24f-94f6
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00454
epssPercentile: 0.37424
ingestedAt: '2026-10-08T11:31:27.559Z'
---

## Overview

OctoPrint-SpoolManager is a plugin for managing spools and all their usage metadata. In versions 1.8.0a2 and older of the testing branch and versions 1.7.7 and older of the stable branch, the APIs of the OctoPrint-SpoolManager plugin do not correctly enforce authentication or authorization checks. This issue has been patched in versions 1.8.0a3 of the testing branch and 1.7.8 of the stable branch. The impact of this vulnerability is greatly reduced when using OctoPrint version 1.11.2 and newer.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.