---
id: CVE-2025-66911
title: >-
  Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control
  vulnerability in the user online status query functionality
summary: >-
  Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control
  vulnerability in the user online status query functionality. The
  handleQueryUserOnlineStatusesRequest() method in UserServiceController.java
  allows any authent…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-284
  - CWE-639
vendor: turms-im
product: turms
affected:
  - turms = 0.10.0-snapshot
published: '2025-12-19'
updated: '2026-10-05'
sourceUpdated: '2026-10-05T18:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66911'
references:
  - url: >-
      https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.md
    label: cve@mitre.org
  - url: 'https://github.com/turms-im/turms'
    label: cve@mitre.org
  - url: >-
      https://github.com/turms-im/turms/blob/develop/turms-service/src/main/java/im/turms/service/domain/user/access/servicerequest/controller/UserServiceController.java#L239
    label: cve@mitre.org
  - url: >-
      https://github.com/Xzzz111/public_cve_report/blob/main/CVE-2025-66911_report.md
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00332
epssPercentile: 0.24185
ingestedAt: '2026-10-05T18:29:11.155Z'
---

## Overview

Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest() method in UserServiceController.java allows any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks.

## Affected

- `turms = 0.10.0-snapshot`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.