Vaelsys VaelsysV4 4.1.0 User Creation /grid/vgrid_server.php improper authorization ⚔ [Disputed]

Summaryinfo

A vulnerability was found in Vaelsys VaelsysV4 4.1.0. It has been rated as critical. This issue affects some unknown processing of the file /grid/vgrid_server.php of the component User Creation Handler. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2025-8261. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. It is still unclear if this vulnerability genuinely exists. The vendor explains: "Based on Vaelsys' analysis, the reported behavior does not allow actions beyond those already permitted to authenticated administrative users, and no change in system configuration or operational practices is necessary."

Detailsinfo

A vulnerability was found in Vaelsys VaelsysV4 4.1.0 (Video Surveillance Software) and classified as critical. This issue affects an unknown function of the file /grid/vgrid_server.php of the component User Creation Handler. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability.

The weakness was shared 03/20/2026. The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-8261. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1548.002 for this issue. The advisory points out:

A report was submitted claiming that the Vaelsys V4 platform allows arbitrary user account creation, including the creation of administrative users, by sending crafted POST requests to the grid/vgrid_server.php endpoint and bypassing authentication and authorization controls. During Vaelsys internal testing and code review, this behavior could not be reproduced. User creation operations were confirmed to require a valid session authenticated with administrative privileges. Attempts to create users using unauthenticated sessions, or sessions authenticated as non-administrative users, were unsuccessful. As a result, the reported behavior reflects intended functionality rather than a security vulnerability. An authenticated administrator is only able to perform actions that are already permitted by their assigned role, and no authentication bypass, privilege escalation, or unauthorized access was identified.

The exploit is available at github.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The vendor explains: "Based on Vaelsys' analysis, the reported behavior does not allow actions beyond those already permitted to authenticated administrative users, and no change in system configuration or operational practices is necessary." By approaching the search of inurl:grid/vgrid_server.php it is possible to find vulnerable targets with Google Hacking.

The advisory contains the following remark:

No specific workarounds or mitigations are required for this issue. Administrators are encouraged to continue following general security best practices, but no additional measures are required as a result of this report.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Video Surveillance Software

Vendor

• Vaelsys

Name

• VaelsysV4

Version

• 4.1.0

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #616924: Vaelsys Vaelsys V4 v4.1.0 Unauthorized User Creation Vulnerability (by waiwai24)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion