CVE Intelligence
Analysis AI-assisted

CVE-2025-7013: QR Menu Pro Menu Panel Authorization Bypass via User-Controlled Key

CVE-2025-7013 describes an authorization bypass in the Menu Panel of QR Menu Pro Smart Menu Systems, classified as CWE-639 (authorization bypass through a user-controlled key). The record indicates that trusted identifiers can be abused. NVD scores it 9.8 (critical) under CVSS 3.1, while the USOM CNA entry lists 5.7.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-7013 is an authorization bypass classified as CWE-639, in which a key supplied or controlled by the user is trusted to select a resource. The Menu Panel of QR Menu Pro Smart Menu Systems is the named affected component. The vendor did not respond to early disclosure contact.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high confidentiality, integrity and availability impact.
  • The USOM CNA entry lists a score of 5.7 under CVSS 3.1.
  • Based on the weakness class, a successful bypass could allow access to data or functions tied to identifiers the user should not control. The record does not describe which data would be exposed.

Affected products and versions

  • Product recorded: Qrmenumpro Menu Panel.
  • Version range recorded: through 29012026 (listed as less than or equal to 29012026). This string resembles a date rather than a conventional version number, so its meaning should be confirmed with the sources.
  • No fixed version is listed in the record.

Exploitation status

  • This CVE is not listed in the CISA KEV catalog in the record.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • No vendor fix is recorded. Because the vendor did not respond to disclosure contact, an official patch may not be available. The absence of a listed fix does not prove that none exists.
  • Where operationally feasible, restrict network access to the Menu Panel to trusted administrators.
  • Enforce server-side ownership and authorization checks on every request that references an object identifier, rather than trusting identifiers supplied by the client.
  • Follow advisories from USOM and Siber Güvenlik.

Detection guidance

  • Review application and web logs for Menu Panel requests where referenced identifiers do not belong to the authenticated account.
  • Watch for unusual volumes of requests that vary identifier values across many records in a short period.
  • Treat such findings as indicators for investigation, not as confirmation of compromise.

Limitations of the available information

  • The record does not describe the vulnerable endpoint, the parameter involved, or the exposed data in detail.
  • NVD metrics indicate that no privileges and no user interaction are required, but the record does not explain the exact conditions.
  • Fixed versions, vendor statements, EPSS and SSVC data are absent.
  • The version string appears date-like and may not be a standard version number.

Frequently asked questions

What type of weakness is CVE-2025-7013?

The record classifies it as CWE-639, an authorization bypass through a user-controlled key, often described as an insecure direct object reference.

Is CVE-2025-7013 known to be exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.