{"id":29408,"date":"2025-04-23T02:49:45","date_gmt":"2025-04-23T02:49:45","guid":{"rendered":""},"modified":"2025-09-08T12:32:43","modified_gmt":"2025-09-08T18:32:43","slug":"cve-2025-30215-high-risk-cross-account-exploitation-in-nats-server-versions","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-30215-high-risk-cross-account-exploitation-in-nats-server-versions\/","title":{"rendered":"CVE-2025-30215: High-Risk Cross-Account Exploitation in NATS-Server Versions<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

CVE-2025-30215 is a significant vulnerability affecting NATS-Server, a high-performance server for NATS.io, known for being a cloud and edge native messaging system. This vulnerability was discovered in versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1. It exposes a weakness in the management of JetStream assets, allowing unauthorized access<\/a> to administrative actions on any JS asset in any other account. This issue affects a wide range of users and organizations that employ NATS-Server within their infrastructure, posing serious risks of system compromise or data<\/a> destruction.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-30215
\nSeverity: Critical (9.6)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: None
\nImpact: System compromise, potential data leakage<\/a>, and data destruction<\/p>\n

Affected Products<\/strong><\/p>

\r\n

\r\n \r\n \"Ameeba\r\n <\/a>\r\n A new way to communicate\r\n <\/h2>\r\n\r\n

\r\n Ameeba Chat is built on encrypted identity, not personal profiles.\r\n <\/p>\r\n\r\n

\r\n Message, call, share files, and coordinate with identities kept separate.\r\n <\/p>\r\n\r\n