{"id":"CVE-2025-14660","summary":"DecoCMS Mesh Workspace Domain api.ts createTool access control","details":"A flaw has been found in DecoCMS Mesh up to 1.0.0-alpha.31. Affected by this vulnerability is the function createTool of the file packages/sdk/src/mcp/teams/api.ts of the component Workspace Domain Handler. This manipulation of the argument domain causes improper access controls. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been published and may be used. Upgrading to version 1.0.0-alpha.32 addresses this issue. Patch name: 5f7315e05852faf3a9c177c0a34f9ea9b0371d3d. It is recommended to upgrade the affected component.","modified":"2026-08-12T03:51:36.824034256Z","published":"2025-12-14T12:32:08.752Z","database_specific":{"cwe_ids":["CWE-266","CWE-284"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14660.json","unresolved_ranges":[{"extracted_events":[{"introduced":"1.0.0-alpha.0"},{"last_affected":"1.0.0-alpha.0"},{"introduced":"1.0.0-alpha.7"},{"last_affected":"1.0.0-alpha.7"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"VulDB"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14660.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14660"},{"type":"ADVISORY","url":"https://vuldb.com/?id.336392"},{"type":"ADVISORY","url":"https://vuldb.com/?submit.713741"},{"type":"REPORT","url":"https://github.com/decocms/mesh/pull/1967"},{"type":"REPORT","url":"https://github.com/decocms/mesh/pull/1967#issue-3700934099"},{"type":"REPORT","url":"https://github.com/decocms/mesh/pull/1967#issuecomment-3622379237"},{"type":"REPORT","url":"https://vuldb.com/?ctiid.336392"},{"type":"FIX","url":"https://github.com/decocms/mesh/commit/5f7315e05852faf3a9c177c0a34f9ea9b0371d3d"},{"type":"FIX","url":"https://github.com/decocms/mesh/releases/tag/runtime-v1.0.0-alpha.32"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/decocms/studio","events":[{"introduced":"30c2901e7d1d1b641d7d24ad909e3f35e451653e"},{"fixed":"5f7315e05852faf3a9c177c0a34f9ea9b0371d3d"},{"fixed":"2ba6478c30c52f640df09098744294380946f4a1"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"1.0.0-alpha.1"},{"last_affected":"1.0.0-alpha.1"},{"introduced":"1.0.0-alpha.2"},{"last_affected":"1.0.0-alpha.2"},{"introduced":"1.0.0-alpha.3"},{"last_affected":"1.0.0-alpha.3"},{"introduced":"1.0.0-alpha.4"},{"last_affected":"1.0.0-alpha.4"},{"introduced":"1.0.0-alpha.5"},{"last_affected":"1.0.0-alpha.5"},{"introduced":"1.0.0-alpha.6"},{"last_affected":"1.0.0-alpha.6"},{"introduced":"1.0.0-alpha.8"},{"last_affected":"1.0.0-alpha.8"},{"introduced":"1.0.0-alpha.9"},{"last_affected":"1.0.0-alpha.9"},{"introduced":"1.0.0-alpha.10"},{"last_affected":"1.0.0-alpha.10"},{"introduced":"1.0.0-alpha.11"},{"last_affected":"1.0.0-alpha.11"},{"introduced":"1.0.0-alpha.12"},{"last_affected":"1.0.0-alpha.12"},{"introduced":"1.0.0-alpha.13"},{"last_affected":"1.0.0-alpha.13"},{"introduced":"1.0.0-alpha.14"},{"last_affected":"1.0.0-alpha.14"},{"introduced":"1.0.0-alpha.15"},{"last_affected":"1.0.0-alpha.15"},{"introduced":"1.0.0-alpha.16"},{"last_affected":"1.0.0-alpha.16"},{"introduced":"1.0.0-alpha.17"},{"last_affected":"1.0.0-alpha.17"},{"introduced":"1.0.0-alpha.18"},{"last_affected":"1.0.0-alpha.18"},{"introduced":"1.0.0-alpha.19"},{"last_affected":"1.0.0-alpha.19"},{"introduced":"1.0.0-alpha.20"},{"last_affected":"1.0.0-alpha.20"},{"introduced":"1.0.0-alpha.21"},{"last_affected":"1.0.0-alpha.21"},{"introduced":"1.0.0-alpha.22"},{"last_affected":"1.0.0-alpha.22"},{"introduced":"1.0.0-alpha.23"},{"last_affected":"1.0.0-alpha.23"},{"introduced":"1.0.0-alpha.24"},{"last_affected":"1.0.0-alpha.24"},{"introduced":"1.0.0-alpha.25"},{"last_affected":"1.0.0-alpha.25"},{"introduced":"1.0.0-alpha.26"},{"last_affected":"1.0.0-alpha.26"},{"introduced":"1.0.0-alpha.27"},{"last_affected":"1.0.0-alpha.27"},{"introduced":"1.0.0-alpha.28"},{"last_affected":"1.0.0-alpha.28"},{"introduced":"1.0.0-alpha.29"},{"last_affected":"1.0.0-alpha.29"},{"introduced":"1.0.0-alpha.30"},{"last_affected":"1.0.0-alpha.30"},{"introduced":"1.0.0-alpha.31"},{"last_affected":"1.0.0-alpha.31"}]}}],"versions":["1.0.0-alpha.1","1.0.0-alpha.10","1.0.0-alpha.11","1.0.0-alpha.12","1.0.0-alpha.13","1.0.0-alpha.14","1.0.0-alpha.15","1.0.0-alpha.16","1.0.0-alpha.17","1.0.0-alpha.18","1.0.0-alpha.19","1.0.0-alpha.2","1.0.0-alpha.20","1.0.0-alpha.21","1.0.0-alpha.22","1.0.0-alpha.23","1.0.0-alpha.24","1.0.0-alpha.25","1.0.0-alpha.26","1.0.0-alpha.27","1.0.0-alpha.28","1.0.0-alpha.29","1.0.0-alpha.3","1.0.0-alpha.30","1.0.0-alpha.4","1.0.0-alpha.5","1.0.0-alpha.6","1.0.0-alpha.8","1.0.0-alpha.9","v1.0.0-alpha.31","v1.0.0-alpha.30","v1.0.0-alpha.29","v1.0.0-alpha.28","v1.0.0-alpha.27","v1.0.0-alpha.26","v1.0.0-alpha.25","v1.0.0-alpha.24","bindings-v1.0.1-alpha.24","v1.0.0-alpha.23","v1.0.0-alpha.22","v1.0.0-alpha.21","v1.0.0-alpha.20","v1.0.0-alpha.19","v1.0.0-alpha.18","v1.0.0-alpha.17","v1.0.0-alpha.16","v1.0.0-alpha.15","v1.0.0-alpha.14","v1.0.0-alpha.13","runtime-v1.0.0-alpha.41","mesh-npm-v1.0.0-alpha.12","mesh-v0.2.5","mesh-npm-v1.0.0-alpha.9","runtime-v1.0.0-alpha.40","mesh-npm-v1.0.0-alpha.8","mesh-v0.2.4","mesh-npm-v1.0.0-alpha.6","mesh-npm-v1.0.0-alpha.4","mesh-npm-v1.0.0-alpha.3","mesh-npm-v1.0.0-alpha.2","mesh-npm-v1.0.0-alpha.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-14660.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}