CVE-2025-61119

Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities. Attackers may gain unauthorized access to user details and obtain group information, including entry codes, by manipulating API request parameters. Successful exploitation could result in privacy breaches, unauthorized group access, and misuse of the platform.

• CWE-284

• https://kar1oz.notion.site/Kanova-2629a473ecb2801bac89ce99d0b30df7

Published

Oct 30, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-61113TalkTalk 3.3.6 Android App contains improper access control …7.5
• CVE-2025-611142nd Line Android App version v1.2.92 and before (package nam…7.5
• CVE-2025-61115ABC Fine Wine & Spirits Android App version v.11.27.5 and be…7.5
• CVE-2025-61116AdForest - Classified Android App version 4.0.12 (package na…7.5
• CVE-2025-61117Senza: Keto & Fasting Android App version 2.10.15 (package n…7.5
• CVE-2025-61118mCarFix Motorists App version 2.3 (package name com.skytop.m…7.5
• CVE-2025-6112A vulnerability, which was classified as critical, has been …8.8
• CVE-2025-61120AG Life Logger Android App version v1.0.2.72 and before (pac…7.5
• CVE-2025-61121Mobile Scanner Android App version 2.12.38 (package name com…7.5
• CVE-2025-61128Stack-based buffer overflow vulnerability in WAVLINK QUANTUM…9.1
• CVE-2025-6113A vulnerability, which was classified as critical, was found…8.8
• CVE-2025-61132A Host Header Injection vulnerability in the password reset …7.1