Bug 2371363 (CVE-2025-5962)

Summary:	CVE-2025-5962 rhel-lightspeed: Improper Access Control in Lightspeed History Management Allows Local Privilege Manipulation
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-06-10 06:13:23 UTC

Improper Access Control vulnerability in the com.redhat.lightspeed.history service of the Lightspeed platform. The issue stems from a lack of proper authorization checks in the methods handling user history, allowing any local user to inject, retrieve, or delete the chat history of other users. An attacker can craft and insert a command such as sudo rm -rf / into another user's chat history, relying on trust in past prompts to trigger harmful command execution. This flaw can be exploited without authentication, user interaction, or elevated privileges, affecting all users on the shared system.