CVE-2025-55886

MEDIUM

ARD Payment History API - Insecure Direct Object Reference

Title source: manual
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-55886. PoCs published by 0xZeroSec.

AI-analyzed exploit summary This repository contains a writeup describing an Insecure Direct Object Reference (IDOR) vulnerability in ARD GEC en Ligne. The flaw allows authenticated attackers to access other users' payment history by manipulating the `fe_uid` parameter in the payment history API endpoint.

Description

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists in the `fe_uid` parameter of the payment history API endpoint. An authenticated attacker can manipulate this parameter to access the payment history of other users without authorization.

Exploits (1)

nomisec WRITEUP 3 stars
by 0xZeroSec · poc
https://github.com/0xZeroSec/CVE-2025-55886

This repository contains a writeup describing an Insecure Direct Object Reference (IDOR) vulnerability in ARD GEC en Ligne. The flaw allows authenticated attackers to access other users' payment history by manipulating the `fe_uid` parameter in the payment history API endpoint.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: ARD GEC en Ligne - Not versioned
Auth required
Prerequisites: Authenticated access to the ARD GEC en Ligne platform
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Various Sources
https://services.ard.fr

Scores

CVSS v3 6.5
EPSS 0.0033
EPSS Percentile 24.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-693
Status published
Published Sep 22, 2025
Tracked Since Feb 18, 2026