CVE-2025-55886

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` parameter of the payment history API endpoint. An authenticated attacker can manipulate this parameter to access the payment history of other users without authorization.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.36% chance of exploitation in the next 30 days, 29th percentile

Published

2025-09-22

Updated

2025-11-17

Proof-of-concept exploits (1)

• 0xZeroSec/CVE-2025-558863★ · 2025-09-20

References

• CVE Record
• NVD entry

Related

• CVE-2025-55885
• CVE-2025-55887
• CVE-2025-55888
• CVE-2025-55853
• CVE-2025-55852
• CVE-2025-55904