An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access admin…

published 2025-12-16 10 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-203827

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits: 0; none known

An authorization bypass vulnerability in FileMaker Server Admin Console allowed administrator roles with minimal privileges to access administrative features such as viewing license details and downloading application logs. This vulnerability has been fully addressed in FileMaker Server 22.0.4.

Patch / fix

fixed in 1

Claris FileMaker Server 22.0.4

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 10 mo ago (2025-12-16)

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

Claris FileMaker Server

Classification

Weakness

CWE-285 Improper Authorization

References

support.claris.com /s/answerview?anum=000049056&language=en_US
vendor-advisory

Sources

CVE List CVE-2025-46296
NVD CVE-2025-46296

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary