# CVE-2025-62180: Pegasystems Pega Platform authorization bypass via crafted URLs

Source: https://junglewise.ai/threats/cve-2025-62180-pegasystems-pega-platform-authorization-bypass-via-crafted-urls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-06-23  
License: CC BY 4.0 with a link back

CVE-2025-62180 · Severity: info · CVSS 7.1 · Published 2026-06-23

The Pega Platform, a popular enterprise software suite for workflow automation and customer engagement, contains a security flaw in its authorization system. An authenticated user could bypass intended access controls by using specially crafted web addresses (URLs) to view sensitive data they are not authorized to see. This could lead to the unauthorized exposure of internal business information or customer records.

Technologies: [Pegasystems Pega Platform](https://junglewise.ai/threats/technologies/pega-platform). Vendors: [Pegasystems](https://junglewise.ai/threats/vendors/pegasystems).

## Quick answers

**Is CVE-2025-62180 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62180 being exploited in the wild.

**How severe is CVE-2025-62180?** Informational severity, with a CVSS score of 7.1, published 23 June 2026.

**Which products and versions are affected?** Pegasystems Pega Infinity 8.3.0 through 25.1.2; Pegasystems Pega Platform 8.3.0 through 25.1.2.

**Is there a fix for CVE-2025-62180?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-62180 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-62180?** Check whether you run Pegasystems Pega Infinity or Pegasystems Pega Platform at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization weakness (CWE-639: Authorization Bypass Through User-Controlled Key) exists in Pega Platform versions 8.3.0 through Infinity 25.1.2. The vulnerability allows a network-based attacker with low-level authenticated privileges to access or execute functions without proper authorization by manipulating URL parameters. This can result in high confidentiality impact as attackers may retrieve data outside of their assigned permissions. The issue is addressed in Pega Infinity 25.1.3 and various hotfixes for older versions (e.g., HFIX-D554, HFIX-D589). Pega Cloud environments are being proactively patched by the vendor.

## Affected products

- Pegasystems Pega Platform / Pega Infinity 8.3.0 through 25.1.2

## Timeline

- 2025-11-19: advisory: Initial remediation note published for I25 vulnerability series
- 2026-06-22: advisory: Updated remediation note published for H26 vulnerability series
- 2026-06-23: disclosed: CVE-2025-62180 published to NVD

## References

- [https://support.pega.com/support-doc/pega-security-advisory-h26-vulnerability-remediation-note](https://support.pega.com/support-doc/pega-security-advisory-h26-vulnerability-remediation-note)
- [https://support.pega.com/support-doc/pega-security-advisory-i25-vulnerability-remediation-note](https://support.pega.com/support-doc/pega-security-advisory-i25-vulnerability-remediation-note)

## Related threats

- [Pegasystems Pega Platform improper validation of loop condition inputs](https://junglewise.ai/threats/cve-2026-13761-pegasystems-pega-platform-improper-validation-of-loop-condition)
- [Pegasystems Pega Platform cryptographic signature validation bypass](https://junglewise.ai/threats/cve-2026-10754-pegasystems-pega-platform-cryptographic-signature-validation)
- [Pegasystems Pega Platform reflected XSS in Dev Studio](https://junglewise.ai/threats/cve-2026-1563-pegasystems-pega-platform-reflected-xss-in-dev-studio)
- [Pegasystems Pega Platform stored XSS in Dev Studio](https://junglewise.ai/threats/cve-2026-1562-pegasystems-pega-platform-stored-xss-in-dev-studio)
- [Pegasystems Pega Platform stored XSS in Prediction Studio](https://junglewise.ai/threats/cve-2025-62184-pegasystems-pega-platform-stored-xss-in-prediction-studio)