# CVE-2025-65238: Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version…

Source: https://junglewise.ai/threats/cve-2025-65238-incorrect-access-control-in-the-getsubusersbyprovider-function-of  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-26  
License: CC BY 4.0 with a link back

CVE-2025-65238 · Severity: medium · CVSS 6.5 · Published 2025-11-26

Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information.

Technologies: [Opencode Ussd Gateway](https://junglewise.ai/threats/technologies/ussd-gateway). Vendors: [Opencode](https://junglewise.ai/threats/vendors/opencode).

## Quick answers

**Is CVE-2025-65238 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-65238 being exploited in the wild.

**How severe is CVE-2025-65238?** Medium severity, with a CVSS score of 6.5, published 26 November 2025.

**Which products and versions are affected?** Opencode Ussd Gateway. The advisory does not name versions.

**Is there a fix for CVE-2025-65238?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-65238?** Check whether you run Opencode Ussd Gateway. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Opencode Ussd Gateway

## Related threats

- [Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version…](https://junglewise.ai/threats/cve-2025-65239-incorrect-access-control-in-the-aux1-ocussd-trace-endpoint-of)
- [A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to…](https://junglewise.ai/threats/cve-2025-65237-a-reflected-cross-site-scripted-xss-vulnerability-in-opencode)
- [OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID…](https://junglewise.ai/threats/cve-2025-65236-opencode-systems-ussd-gateway-oc-release-5-was-discovered-to)
- [OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability…](https://junglewise.ai/threats/cve-2025-65235-opencode-systems-ussd-gateway-oc-release-5-version-6-13-11-was)