Conjur Secrets Manager injection & permission bypass before 13.6.1 & 1.22.1
CVE-2025-49829 Published on July 15, 2025
Conjur OSS and Secrets Manager, Self-Hosted (formerly Conjur Enterprise) missing validations
Conjur provides secrets management and application identity for infrastructure. Missing validations in Secrets Manager, Self-Hosted allows authenticated attackers to inject resources into the database and to bypass permission checks. This issue affects Secrets Manager, Self-Hosted (formerly Conjur Enterprise) prior to versions 13.5.1 and 13.6.1 and Conjur OSS prior to version 1.22.1. Conjur OSS version 1.22.1 and Secrets Manager, Self-Hosted versions 13.5.1 and 13.6.1 fix the issue.
Vulnerability Analysis
CVE-2025-49829 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2025-49829 has been classified to as an AuthZ vulnerability or weakness.
Affected Versions
cyberark conjur:- Version Conjur OSS < 1.22.1 is affected.
- Version Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) < 13.5.1 is affected.
- Version Secrets Manager, Self-Hosted (formerly known as Conjur Enterprise) = 13.6 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.