{"id":"CVE-2024-25723","aliases":["GHSA-vf7j-cmrj-pmmm","PYSEC-2026-2072"],"title":"ZenML Server Remote Privilege Escalation Vulnerability","summary":"ZenML Server Remote Privilege Escalation Vulnerability","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","vendor":"zenml","product":"zenml","ecosystem":"pip","affected":["zenml < 0.42.2","zenml >= 0.43.0, < 0.43.1","zenml >= 0.45.0, < 0.46.7","zenml >= 0.44.0, < 0.44.4"],"patched":["zenml 0.42.2","zenml 0.43.1","zenml 0.46.7","zenml 0.44.4"],"published":"2024-02-27","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-vf7j-cmrj-pmmm","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25723"},{"url":"https://github.com/zenml-io/zenml"},{"url":"https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2"},{"url":"https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1"},{"url":"https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4"},{"url":"https://www.zenml.io/blog/critical-security-update-for-zenml-users"}],"tags":["osv","pip","exploit-available"],"epss":0.70785,"epssPercentile":0.99396,"ingestedAt":"2026-07-08T18:25:53.309Z","exploits":{"github":1,"githubRepos":["https://github.com/david-botelho-mariano/exploit-CVE-2024-25723"],"nuclei":["CVE-2024-25723"],"checkedAt":"2026-10-27T16:41:54.414Z"},"exploitAvailable":true,"slug":"CVE-2024-25723","body":"## Overview\n\nZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the `/api/v1/users/{user_name_or_id}/activate` REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4, 0.43.1, and 0.42.2.\n\n## Affected packages\n\n- `zenml < 0.42.2`\n- `zenml >= 0.43.0, < 0.43.1`\n- `zenml >= 0.45.0, < 0.46.7`\n- `zenml >= 0.44.0, < 0.44.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `zenml 0.42.2`\n- `zenml 0.43.1`\n- `zenml 0.46.7`\n- `zenml 0.44.4`","depth":"twilight","depthScore":62,"depthScoreParts":{"impact":35.8,"likelihood":14.2,"exploitation":12,"ransomware":0},"changes":[{"seq":4704,"id":"CVE-2024-25723","ts":1788887200294,"field":"exploit_available","old":"false","new":"true"},{"seq":3587,"id":"CVE-2024-25723","ts":1788886316787,"field":"exploit_available","old":"true","new":"false"},{"seq":2441,"id":"CVE-2024-25723","ts":1788882985528,"field":"exploit_available","old":"false","new":"true"},{"seq":1470,"id":"CVE-2024-25723","ts":1788882398819,"field":"exploit_available","old":"true","new":"false"},{"seq":584,"id":"CVE-2024-25723","ts":1788881835459,"field":"exploit_available","old":"false","new":"true"}]}