# CVE-2025-46718: sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others

Source: https://junglewise.ai/threats/cve-2025-46718-sudo-rs-allows-low-privilege-users-to-enumerate-privileges-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-13  
License: CC BY 4.0 with a link back

CVE-2025-46718 · Severity: low · CVSS 3.1 · Published 2025-05-13

sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others

Technologies: [sudo-rs (crates.io)](https://junglewise.ai/threats/technologies/sudo-rs). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2025-46718 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-46718 being exploited in the wild.

**How severe is CVE-2025-46718?** Low severity, with a CVSS score of 3.1, published 13 May 2025.

**Which products and versions are affected?** sudo-rs (crates.io) SEMVER:introduced=0,fixed=0.2.6.

**Is there a fix for CVE-2025-46718?** Yes. sudo-rs (crates.io): upgrade to 0.2.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-46718?** Check whether you run sudo-rs (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- sudo-rs (crates.io): upgrade to 0.2.6 or later

  ```sh
  cargo update -p sudo-rs
  ```


## Affected products

- sudo-rs (crates.io) SEMVER:introduced=0,fixed=0.2.6

## Identifiers

- CVE-2025-46718
- GHSA-w9q3-g4p5-5q2r

## Related threats

- [sudo-rs doesn't record authenticating user properly in timestamp](https://junglewise.ai/threats/cve-2025-64517-sudo-rs-doesn-t-record-authenticating-user-properly-in-timestamp)
- [sudo-rs: Partial password reveal is possible after timeout](https://junglewise.ai/threats/cve-2025-64170-sudo-rs-partial-password-reveal-is-possible-after-timeout)
- [sudo-rs Allows Low Privilege Users to Discover the Existence of Files in Inaccessible Folders](https://junglewise.ai/threats/cve-2025-46717-sudo-rs-allows-low-privilege-users-to-discover-the-existence-of)
- [Trifecta Tech Foundation sudo-rs path traversal in session file handling](https://junglewise.ai/threats/cve-2023-42456-trifecta-tech-foundation-sudo-rs-path-traversal-in-session-file)