Quick answers
- Is CVE-2025-63293 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-63293 being exploited in the wild.
- How severe is CVE-2025-63293?
- Medium severity, with a CVSS score of 6.5, published 3 November 2025.
- Which products and versions are affected?
- Fairsketch RISE Ultimate Project Manager & CRM 3.9.4.
- Is there a fix for CVE-2025-63293?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-63293 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2025-63293?
- Check whether you run Fairsketch RISE Ultimate Project Manager & CRM or Fairsketch Rise Ultimate Project Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A missing authorization check (CWE-862) exists within the ticketing and commenting API of FairSketch Rise Ultimate Project Manager & CRM version 3.9.4. A remote authenticated attacker can exploit this by sending crafted requests to the API to append comments or upload attachments to tickets for which they lack the necessary view or edit permissions. The vulnerability stems from the application failing to verify if the requesting user has the appropriate relationship or authorization level for the specific ticket ID being modified. While the attacker cannot necessarily read the existing ticket content through this specific flaw, they can compromise the integrity of the ticket data and potentially use it as a vector for further attacks via malicious attachments.
Affected products
- FairSketch Rise Ultimate Project Manager & CRM 3.9.4
Timeline
- 2025-11-03: disclosed
- 2025-11-03: advisory