CVE-2025-8261 is a disputed report with a record score of high (CVSS 7.3), covering improper authorization in the user creation handler of VaelsysV4 4.1.0. The vendor says it cannot reproduce the problem and rates it as no security impact. The related command injection, CVE-2025-8259, is real and fixed.
What's affected
The record names VaelsysV4 4.1.0 and the file /grid/vgrid_server.php, in the User Creation Handler component. The reporter claimed that crafted requests could create user accounts, including administrator accounts, without logging in. The record itself says the real existence of the issue is still doubted.
The vendor advisory disagrees with the record on severity and on impact:
- The record gives a CVSS 3.1 score of 7.3 with the vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, which implies no login needed and some impact. - The vendor rates the severity as none and the status as no security impact, and lists no affected products or versions.
- The vendor says user creation needs an administrator session, and that unauthenticated and non-admin sessions fail.
The advisory is also inconsistent on fixes. Its fixes section says no fix was issued for this report, while its change log carries a fix released entry dated 2026-03-20. I could not reconcile those two statements, so I do not name a fixed version.
How to check if you're exposed
Start with what is real. Check whether your VaelsysV4 is on a version fixed for CVE-2025-8259, which shares the same file, and apply that update.
Then review the list of user accounts on the device. Look for accounts you did not create, especially administrator accounts, and compare against your records.
Check the web server logs for POST requests to /grid/vgrid_server.php from addresses outside your administration network.
grep "vgrid_server.php" /var/log/apache2/access.log | tail -n 50
What to do now
- Confirm your Vaelsys platform and version, and apply the updates for CVE-2025-8259.
- Audit existing user accounts and remove any you cannot explain.
- Keep the web interface off public networks and limit it to trusted administration addresses.
- Enable logging for account creation and review it regularly.
- Re-check the vendor advisory for updates, since its wording on fixes is inconsistent.
Why it matters
The record lists CWE-266 (Incorrect Privilege Assignment) and CWE-285 (Improper Authorization). If the claim were true, an anonymous caller could create a privileged account, which would be a serious flaw. The vendor says the behavior is intended for administrators and gives no such path to anonymous users.
Disputed records are a useful reminder that a CVE entry is a claim, not a verdict. Your job is to hold both statements, test what you can on your own systems, and not ignore the neighbors. Here, the neighboring command injection in the same file is confirmed by the vendor and has a patch. The record does not flag this CVE as CISA KEV and makes no claim of exploitation in the wild, though it says the exploit has been made public.
Quick check
Is CVE-2025-8261 a real vulnerability?
That is disputed. The record says its existence is doubted, and the vendor says it found no authentication bypass or privilege escalation. Keep it on your watch list and patch the related CVE-2025-8259.
Should I ignore it?
No. Audit your user accounts and restrict the web interface anyway. Those steps cost little and cover both this report and the confirmed command injection.
Sources
- CVE-2025-8261 on Safeguard Gold
- Vaelsys security advisory VSEC_V4_2025_07_0003
- NVD record for CVE-2025-8261, published 2025-07-28
Last reviewed: 18 October 2026.
