CVE-2025-51308: 
NixOS vulnerability analysis and mitigation

CVE-2025-51308 is a broken access control (Missing Authorization) vulnerability in Gatling Enterprise that allows low-privileged users to access admin-only REST API read endpoints. Affected versions are all Gatling Enterprise releases below 1.25.0. The vulnerability was published on August 6, 2025, with a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, Feedly).

The root cause is CWE-862 (Missing Authorization): Gatling Enterprise fails to verify that the requesting user holds the "admin" role before processing certain read-only REST API calls. Specifically, at least two endpoints — /api/private/teams and /api/private/repositories — are accessible to users with only the "view" role, when they should be restricted to admins. The legitimate non-privileged endpoint is /api/private/roles/teams, which returns only team id and name fields. A public proof-of-concept write-up documents the specific vulnerable endpoints and the exploitation scenario (GitHub PoC).

Exploitation allows a low-privileged ("view" role) authenticated user to retrieve information from admin-only read endpoints, potentially exposing sensitive organizational data such as team configurations and repository details. The confidentiality impact is low and limited to information disclosure; there is no integrity or availability impact. The vulnerability does not enable code execution or lateral movement, but exposed metadata could assist in further reconnaissance or privilege escalation attempts (Red Hat CVE, GitHub PoC).

Public proof-of-concept documentation is available on GitHub, detailing the specific vulnerable API endpoints and exploitation scenario (GitHub PoC, GitHub Repo). There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.028% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Authentication: Log in to the Gatling Enterprise instance with a low-privileged account that holds only the "view" role (not "admin").
2. Identify target endpoints: Determine the base URL of the Gatling Enterprise REST API (e.g., https://<gatling-enterprise-host>/api/private/).
3. Send unauthorized API request: Issue an HTTP GET request to the admin-only endpoint, for example:

   GET /api/private/teams HTTP/1.1
   Host: <gatling-enterprise-host>
   Authorization: Bearer <view-role-user-token>

4. Collect information: Similarly, query /api/private/repositories to retrieve repository details that should be restricted to admin users.
5. Exfiltrate data: Review the API responses for sensitive organizational information such as team configurations, repository names, and associated metadata that can be used for further reconnaissance (GitHub PoC).

• Network: Unexpected HTTP GET requests from non-admin user accounts to /api/private/teams or /api/private/repositories endpoints on the Gatling Enterprise server.
• Logs: Gatling Enterprise API access logs showing "view"-role users successfully receiving 200 OK responses from admin-only endpoints (/api/private/teams, /api/private/repositories) rather than 403 Forbidden responses.
• Behavioral: Repeated or scripted API calls to admin-only endpoints from accounts that do not hold the "admin" role, particularly if the access pattern differs from normal user behavior (GitHub PoC).

Upgrade Gatling Enterprise to version 1.25.0 or later, which introduces proper authorization checks on the affected read-only endpoints (Red Hat CVE, Gatling Products). As an interim measure, restrict network access to the Gatling Enterprise API to trusted users and IP ranges, and review API access logs for unauthorized endpoint access. Implementing strict role-based access controls and auditing existing user role assignments is also recommended.

The vulnerability was noted by RedPacketSecurity on social media shortly after disclosure, and was included in a CISA vulnerability summary for the week of August 4, 2025. No significant vendor statements beyond the patch release or notable researcher commentary beyond the original PoC author (Flo354) have been identified.