CVE-2025-21611: 
TG Station Server vulnerability analysis and mitigation

CVE-2025-21611 affects tgstation-server, a production scale tool for BYOND server management. The vulnerability was discovered on January 3, 2025, and disclosed on January 6, 2025. Prior to version 6.12.3, the software contained an authorization bypass vulnerability where roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled (NVD, GitHub Advisory).

The vulnerability stems from an architectural flaw in the authorization mechanism where the system incorrectly combined role checks using OR logic instead of AND logic when validating user permissions. This implementation error affects the authorization of API methods in relation to user enabled status. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility with low attack complexity (GitHub Advisory).

The vulnerability allows enabled users to access most authorized actions regardless of their assigned permissions. However, the WriteUsers right remains unaffected, preventing users from permanently elevating their account permissions. The high CVSS score indicates potential significant impacts to system confidentiality, integrity, and availability (GitHub Advisory).

The vulnerability requires an attacker to have valid user credentials with enabled status in the system. Once these conditions are met, the attacker can bypass role-based access controls to perform unauthorized actions. The vulnerability was discovered when it was found that users could still read the /Repository endpoint even when RepositoryRights.Read was unset (GitHub Issue).

The vulnerability has been patched in tgstation-server version 6.12.3. As a temporary workaround before updating, administrators can disable all users that should not have full access to the server. The fix involves correcting the logic to properly AND the user enabled role with authorization roles (GitHub Advisory).