CVE-2025-12925 is a high severity missing authorization flaw (CVSS 7.3) in rymcu forest, a Java project, through commit de53ce79db9faa2efc4e79ce1077a302c42a1224. The user dictionary controller exposes four functions without proper checks. It is a rolling release with no version numbers, so confirm the current state upstream.
What's affected
The record says rymcu forest up to commit de53ce79db9faa2efc4e79ce1077a302c42a1224 is affected. The weak code is in UserDicController.java, under src/main/java/com/rymcu/forest/lucene/api/, in the functions getAll, addDic, getAllDic and deleteDic.
The record states that the product operates on a rolling release basis, so there are no version details for either affected or updated releases. That means you cannot use a version number to know whether you are safe. You need the commit your deployment was built from.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. It is network reachable and low complexity with no privileges and no user interaction required, and limited impact on confidentiality, integrity and availability. The description says the exploit is public. The project issue tracker has a report at issue 199.
How to check if you're exposed
- Find out whether you run rymcu forest, and which commit you built from. If you deployed from a Git checkout:
git log -1 --format=%H
git merge-base --is-ancestor de53ce79db9faa2efc4e79ce1077a302c42a1224 HEAD && echo "contains the listed commit"
- Look at the source of
UserDicController.javain your build. See whether the four functions require an authenticated, authorised user. - Check access logs for calls to the user dictionary endpoints from accounts or addresses that should not be using them.
- Check the upstream issue and repository for a fix, and read what it says before relying on it.
The free in-browser scan covers dependencies in your repository, and the Gold page for CVE-2025-12925 tracks this record.
What to do now
- Check the upstream repository for a commit that adds authorisation to these four functions, and rebuild from it. A fix was not confirmed for this post, so check before you assume one exists.
- If no fix exists, add the check yourself. In Spring based projects, that usually means requiring a role on the controller methods.
- Restrict the dictionary endpoints at your gateway or reverse proxy so that only trusted users can call them.
- Review the dictionary content for entries you did not add, and remove them.
- Add authorisation tests, so that an anonymous call to each function returns a denial.
- Pin and record the commit you deploy, since a rolling release has no version to compare.
Why it matters
Missing authorization means the code does the work without asking whether the caller is allowed. The record maps this to CWE-862, missing authorization, and CWE-863, incorrect authorization. The first is a missing check, the second a check that does not do what it should. Both sit near the top of API security lists because they are easy to write by accident and hard to spot in review.
A user dictionary feeds the search index, so changes to it can alter what people find. The effect is limited per the vector, but write access to shared data deserves attention. The record does not flag CVE-2025-12925 as a CISA Known Exploited Vulnerability and does not claim exploitation in the wild.
Quick check
Which version of rymcu forest is fixed?
The record says there are no version details because the product uses a rolling release. Compare your commit with the upstream repository.
Which functions are affected?
getAll, addDic, getAllDic and deleteDic in UserDicController.java, per the record.
Sources
References listed in the CVE record:
Last reviewed: 19 October 2026.
