Is CVE-2025-13474 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13474 being exploited in the wild.

How severe is CVE-2025-13474?

High severity, with a CVSS score of 7.5, published 16 December 2025.

Which products and versions are affected?

Menulux Software Inc. Mobile App before 9.5.8.

Is there a fix for CVE-2025-13474?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-13474 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-13474?

Check whether you run Menulux Software Inc. Mobile App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13474: Menulux Mobile App authorization bypass via user-controlled key

CVE-2025-13474 · Severity: high · CVSS 7.5 · Published 2025-12-16

A vulnerability exists in the Menulux mobile application, which is used for digital menus and restaurant management. An attacker can bypass security checks by manipulating user-controlled identifiers, potentially allowing them to access sensitive information belonging to other users or the business. This could lead to unauthorized data exposure and a breach of customer privacy.

Vendors: Menulux Software Inc..

Quick answers

Is CVE-2025-13474 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13474 being exploited in the wild.
How severe is CVE-2025-13474?: High severity, with a CVSS score of 7.5, published 16 December 2025.
Which products and versions are affected?: Menulux Software Inc. Mobile App before 9.5.8.
Is there a fix for CVE-2025-13474?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-13474 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-13474?: Check whether you run Menulux Software Inc. Mobile App at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass vulnerability (CWE-639) exists in the Menulux Mobile App prior to version 9.5.8. The flaw stems from the application's reliance on user-provided keys or identifiers to perform authorization checks without sufficient server-side validation. A remote, unauthenticated attacker can exploit this by supplying a different user's identifier to the application's API or backend services. Successful exploitation allows the attacker to access sensitive data (Confidentiality: High) that they are not authorized to view. The issue is resolved in version 9.5.8.

Affected products

Menulux Software Inc. Mobile App before 9.5.8

Timeline

2025-12-16: disclosed
2025-12-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.