{"id":86333,"date":"2026-01-20T15:58:17","date_gmt":"2026-01-20T15:58:17","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-46740-unauthorized-administrative-account-name-change","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-46740-unauthorized-administrative-account-name-change\/","title":{"rendered":"CVE-2025-46740: Unauthorized Administrative Account Name Change<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

CVE-2025-46740 is a significant security vulnerability that allows an authenticated user without administrative privileges to change the administrator Account Name. This vulnerability impacts any system or software that does not properly limit the account name changes to the appropriate user roles, potentially leading to system compromise or data leakage. The severity of this issue is underlined by its CVSS Severity Score of 7.5, indicating a high risk to affected systems.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-46740
\nSeverity: High (7.5)
\nAttack Vector: Network
\nPrivileges Required: Low
\nUser Interaction: Required
\nImpact: Unauthorised Administrative Account Name Change, which could lead to system compromise or data leakage.<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Product 1 | Version 1, Version 2
\nProduct 2 | Version 3, Version 4<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability exists within the account management functionality of the affected software. An authenticated user without administrative permissions can exploit this issue by manipulating the request sent to the server to change the account name. If successful, the attacker could change the administrator account name, potentially disrupting the system’s operations or gaining unauthorized access.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is an illustrative example of how the vulnerability might be exploited using a HTTP POST request:<\/p>\n

POST \/changeAccountName HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\nAuthorization: Bearer user_token_without_admin_permissions\n{\n\"accountName\": \"admin\",\n\"newAccountName\": \"new_admin\"\n}<\/code><\/pre>\n
In this example, a malicious user sends a POST request to the “\/changeAccountName” endpoint, attempting to change the “admin” account name to “new_admin” without having proper administrative permissions. The attacker uses a valid user token for authentication, which does not have administrative permissions, thus exploiting the vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview CVE-2025-46740 is a significant security vulnerability that allows an authenticated user without administrative privileges to change the administrator Account Name. This vulnerability impacts any system or software that does not properly limit the account name changes to the appropriate user roles, potentially leading to system compromise or data leakage. The severity of this issue […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86333","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t