CVE-2025-8053 is a critical (CVSS 9.1) insufficient access control granularity in Flipper. The record lists Flipper 3.1.2 as affected. I could not read the vendor advisory, so confirm the fixed version in OpenText article KB0850532 and restrict access to the backend API until you have.
What's affected
The record lists Flipper 3.1.2 as affected.
I could not read the OpenText advisory, which sits behind a support portal page that did not load. Check OpenText's knowledge base article KB0850532 for the fixed version.
The record says a low privilege user could interact with the backend API without sufficient privileges. Its CVSS vector shows no privileges required, which is a little at odds with the phrase low privilege user in the description.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, a score of 9.1. The record cites OpenText's own article KB0850532 as the advisory.
The record's kev flag is false, so the CVE is not in CISA's Known Exploited Vulnerabilities catalog at the time of this review.
How to check if you're exposed
Check the installed Flipper version against 3.1.2. Then check which accounts and networks can reach the backend API, and review API logs for calls made by accounts that should not use those endpoints. OpenText's article is the place to confirm steps.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Open OpenText article KB0850532 and confirm the fixed Flipper version.
- Upgrade from 3.1.2 as soon as that version is available to you.
- Restrict who can reach the backend API at the network layer.
- Review role and permission settings so a low privilege account cannot call administrative endpoints.
- Check API logs for unusual calls from low privilege accounts.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-1220 (insufficient granularity of access control). Access control needs to be enforced per endpoint on the server. If the API trusts the front end to hide administrative functions, then a user who calls the API directly sees everything it exposes.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch for CVE-2025-8053?
The record does not name a fixed version. Treat the product as unpatched, reduce its exposure and check the vendor or project site for news.
Is CVE-2025-8053 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. No advisory I read says it is being exploited.
Sources
- Safeguard Gold entry for CVE-2025-8053
- OpenText knowledge base article KB0850532 (listed in the record, needs portal access) (listed in the record, not retrievable when reviewed)
- NVD record data for CVE-2025-8053, published 2025-10-20, source security@opentext.com
Last reviewed: 18 October 2026.
