VYPR
← All advisories
Medium severity6.5NVD Advisory· Published May 6, 2025· Updated Aug 7, 2026

CVE-2025-4374

CVE-2025-4374

Description

A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin" permissions on the newly created repository.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Red Hat/Red Hat Quay 3v5
    cpe:/a:redhat:quay:3
  • Red Hat/Quay2 versions
    cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:quay:*:*:*:*:*:*:*:*range: <=3.14.0
    • (no CPE)
  • Project Quay/quayv5
    Range: 0

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.