CVE-2026-25233: PEAR Pearweb Roadmap Authorization Logic Flaw
A logic flaw in the roadmap role check of PEAR Pearweb, prior to version 1.33.0, lets users who are not lead maintainers create, update, or delete roadmaps. The issue is fixed in version 1.33.0. The record lists a critical CVSS 3.1 base score of 9.1 from NVD, and no confirmed exploitation appears in the sources consulted.
Overview
PEAR is a framework and distribution system for reusable PHP components. CVE-2026-25233 describes a logic bug in the role check that governs roadmaps in the Pearweb application. According to the record, users who are not lead maintainers can create, update, or delete roadmaps in affected versions. The issue was patched in version 1.33.0.
Impact
The record describes a loss of integrity over roadmap content, since unauthorized users can change or remove roadmaps. The NVD CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, with a base score of 9.1. This vector indicates network access, low complexity, no privileges and no user interaction required, with high integrity and availability impact and no confidentiality impact. The GitHub CNA provides a CVSS 4.0 score of 7.1.
Affected products and versions
- Product: Pear Pearweb
- Affected range: versions before 1.33.0 (less than 1.33.0)
- Fixed version: 1.33.0, as stated in the record description
The record does not include a structured list of fixes, so the fixed version is taken from the description text.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted. Exploitation status should be re-checked against current threat intelligence.
Remediation and mitigation
- Upgrade Pearweb to version 1.33.0 or later, which the record states contains the fix.
- Review the list of users with lead maintainer or maintainer roles and confirm that roadmap changes correspond to authorized activity.
- Check the vendor advisory for any additional guidance on upgrade steps and compatibility.
Detection guidance
- Review application logs and audit trails for roadmap creation, modification, or deletion events performed by accounts that are not lead maintainers.
- Compare the current roadmap content with known good versions or backups to identify unexpected changes.
- Monitor for unusual roadmap activity following any period during which the instance ran a version earlier than 1.33.0.
Limitations of the available information
The record does not provide an EPSS score, an SSVC assessment, or a CWE name, although it lists CWE-783. It does not describe the exact code path of the flaw, the specific role names involved beyond the description, or the deployment conditions under which the issue is reachable. The record does not include a product CPE or a list of fixed commits. These gaps mean the scope of impact in any given deployment cannot be fully confirmed from the available data.
Frequently asked questions
What does CVE-2026-25233 allow?
According to the record, users who are not lead maintainers can create, update, or delete roadmaps in PEAR Pearweb versions before 1.33.0.
Which version fixes the issue?
The record description states that the issue was patched in version 1.33.0. The structured fix list in the record is empty, so the description is the source for this version.
Is this vulnerability known to be actively exploited?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What is the severity score?
NVD provides a CVSS 3.1 base score of 9.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The GitHub CNA provides a CVSS 4.0 score of 7.1.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.