An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.
References
| Link | Resource |
|---|---|
| https://drivelock.help/sb/Content/SecurityBulletins/25-008-DESPrivilegeEsc.htm | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Jan 2026, 15:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:drivelock:drivelock:*:*:*:*:*:*:*:* | |
| First Time |
Drivelock
Drivelock drivelock |
|
| References | () https://drivelock.help/sb/Content/SecurityBulletins/25-008-DESPrivilegeEsc.htm - Vendor Advisory |
18 Dec 2025, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-269 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
17 Dec 2025, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-17 21:16
Updated : 2026-01-02 15:54
NVD link : CVE-2025-67793
Mitre link : CVE-2025-67793
CVE.ORG link : CVE-2025-67793
JSON object : View
Products Affected
drivelock
- drivelock
CWE
CWE-269
Improper Privilege Management