External risk intelligence

CVLand Authorization Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2025-0987

CVLand is a project management application. While such applications can be deployed as internet-facing web portals, they are also frequently deployed in internal or restricted corporate networks. The CVE context does not specify that public-facing deployment is the standard or mandatory configuration for this product.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves an authorization bypass in the CVLand technology, enabling unauthorized access and modification of data. The issue allows for parameter injection, which could lead to significant data compromise. Due to the vendor's lack of response, the full impact and available mitigations are not yet fully understood.

Bypass allows unauthorized access and data changes.
Vendor unresponsive; impact and fixes uncertain.
Confirm relevance and exposure for CVLand.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this by sending a specially crafted request to the CVLand application, bypassing authorization checks due to how user-provided keys are handled. This parameter injection vulnerability could allow an attacker to gain unauthorized access and potentially manipulate data within the application. The vendor has not responded to inquiries about this issue.

Attacker needs network access.
Triggered by sending a malicious request.
Leads to data compromise and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to bypass authorization controls, potentially impacting the integrity and confidentiality of system and user data within the CVLand application when supported by specific configurations.

System data integrity could be affected.
Unauthorized access to system data may occur.
Impact to service behavior is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This authorization bypass vulnerability in CVLand likely impacts application owners responsible for its deployment and configuration. The first practical step is to identify all instances of CVLand within your environment, assess their accessibility, and determine their business criticality. Once ownership is confirmed, a risk-based remediation plan can be developed.

Application owners should manage the issue.
Verify CVLand's network exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CB Project Ltd. Co. CVLand?

CVLand is a technology used for project management. It helps users organize and track projects, and is often deployed in corporate networks.

What is CVE-2025-0987?

CVE-2025-0987 is an authorization bypass vulnerability in CVLand. It means an attacker could potentially access or change data they shouldn't be able to by injecting parameters into the application.

How can an attacker exploit this CVLand vulnerability?

An attacker could exploit this by sending a specific, crafted request to the CVLand application. This request would take advantage of how the application handles user-controlled keys to bypass normal security checks.

Who should care about this CVLand security issue?

Organizations using CVLand should care, especially if it's accessible from the internet. Even if it's internal, there's a possibility of unauthorized access or data changes.

What is the first step for managing this CVLand vulnerability?

If you are running CVLand, you should first find all instances of it in your environment. Then, determine how exposed it is to the network and how critical it is to your business operations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.