CVE-2025-41077: 
NixOS vulnerability analysis and mitigation

CVE-2025-41077 is an Insecure Direct Object Reference (IDOR) vulnerability in Viafirma Inbox v4.5.13 that allows any authenticated low-privileged user to enumerate all users, access their data, and modify their email addresses. By changing a victim's email and then triggering the password recovery flow, an attacker can fully impersonate any user — including administrators. The vulnerability affects Viafirma Inbox versions prior to 4.5.27. It was reported by INCIBE (Spanish National Cybersecurity Institute) and published on January 12, 2026. The CVSS v3.1 base score is 8.1 (High) and the CVSS v4.0 base score is 8.6 (High) (INCIBE Advisory, NVD).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), meaning the application fails to validate that the requesting user is authorized to access or modify the resource identified by a user-supplied key (e.g., a user ID). An authenticated attacker with minimal privileges can send crafted API requests referencing other users' identifiers to list all accounts, read their profile data, and overwrite their email addresses — all without any server-side authorization check. Once the email is changed to an attacker-controlled address, the standard password recovery functionality can be abused to receive a reset link and take over the target account, including administrative accounts (INCIBE Advisory, NVD).

Successful exploitation allows a low-privileged authenticated attacker to achieve full account takeover of any user in the Viafirma Inbox application, including administrators. This results in high confidentiality impact (access to all user data and administrative functions) and high integrity impact (modification of user records and unauthorized actions within the application). Availability is not directly impacted, but administrative account compromise could lead to broader application misuse, data exfiltration, or disruption of document signing workflows managed by Viafirma Inbox (INCIBE Advisory, NVD).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.031% (0.000310), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires only a valid low-privileged account, making it accessible to any authenticated user of the application (INCIBE Advisory).

1. Obtain a low-privileged account: Register or obtain any valid authenticated session in the Viafirma Inbox application (v4.5.13 or earlier).
2. Enumerate users: Send authenticated API requests that reference user identifiers (e.g., incrementing numeric IDs or UUIDs) to the user listing or profile endpoint to enumerate all accounts in the system.
3. Identify target account: From the enumerated list, identify a high-value target such as an administrator account, noting their user ID and current email address.
4. Modify target email: Send an authenticated API request to the user update endpoint, supplying the target's user ID and replacing their email address with an attacker-controlled email address. The server does not validate that the requester owns the referenced account.
5. Trigger password recovery: Use the application's password recovery feature for the target account. The reset link is sent to the attacker-controlled email address.
6. Reset password and take over: Follow the password reset link to set a new password, then log in as the target user — including with full administrative privileges if an admin account was targeted (INCIBE Advisory, NVD).

• Network: Authenticated API requests referencing user IDs other than the authenticated user's own ID, particularly to user listing or profile update endpoints; sequential or bulk requests to user profile endpoints suggesting enumeration.
• Logs: Application logs showing a single authenticated session accessing or modifying multiple different user records; password reset requests for accounts whose email was recently changed; email change events followed immediately by password reset events for the same account.
• Application Events: User profile email address changes not initiated by the account owner; password reset emails sent to addresses not previously associated with the account; administrative account logins from unfamiliar IP addresses or sessions shortly after a password reset.

Viafirma has released Inbox version 4.5.27, which addresses this vulnerability — organizations should upgrade immediately (NVD). As interim mitigations, implement strict server-side authorization checks to ensure users can only access and modify their own records. Restrict or add additional verification steps (e.g., email confirmation to the original address) to the email change and password recovery workflows. Implement multi-factor authentication (MFA) to reduce the impact of account takeover, and enable monitoring/alerting for bulk user enumeration activity and unexpected email address changes (INCIBE Advisory).

The vulnerability was disclosed by INCIBE (Spain's National Cybersecurity Institute) as part of a coordinated advisory covering multiple vulnerabilities in Viafirma products. Coverage has been limited to automated vulnerability tracking platforms and databases. No notable independent researcher commentary or significant social media discussion has been identified beyond standard CVE publication channels (INCIBE Advisory).