{"id":"CVE-2025-10698","kind":"vulnerability","aliases":["CVE-2025-10698"],"related":[],"title":"OpenText Identity Console: default permissions expose embedded sensitive data","description":"Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity Console on Windows, Linux, and 64 bit allows Retrieve Embedded Sensitive Data.\n\nThis issue affects Identity Console: from 1.8 through 25.2.","summary":"OpenText Identity Console versions 1.8 through 25.2 shipped with incorrect default permissions and a non-release build configuration. An attacker with access to the installed product can retrieve embedded sensitive data.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity-console","linux","opentext","vendor","windows"],"not_affected_if":[],"how_to_check":"- Confirm whether Identity Console is installed and which version it is, using the product's own about page or installed package listing.\n- Check whether the installed version falls within 1.8 through 25.2.","fix":null,"status":"open","published_at":"2026-11-12T17:17:20+00:00","first_seen_at":"2026-11-12T17:39:37+00:00","triaged_at":"2026-11-12T17:40:02+00:00","updated_at":"2026-11-12T17:40:02+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-12T17:40:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"OpenText Identity Console: default permissions expose embedded sensitive data","impact":"medium","summary":"OpenText Identity Console versions 1.8 through 25.2 shipped with incorrect default permissions and a non-release build configuration. An attacker with access to the installed product can retrieve embedded sensitive data.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["identity-console","opentext","windows","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Sensitive data embedded in the product can be retrieved by an attacker","analyst_note":"Check the OpenText advisory for the fixed version, the affected file or setting, and whether authentication is required; the NVD entry alone does not state these.","how_to_check":"- Confirm whether Identity Console is installed and which version it is, using the product's own about page or installed package listing.\n- Check whether the installed version falls within 1.8 through 25.2.\n- unknown for file paths or settings to inspect, as the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running OpenText Identity Console on Windows, Linux, or 64-bit systems in versions 1.8 through 25.2. The sources do not state which deployment or configuration choices make an install exposed, so the full scope is unknown.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4547,"output_tokens":533,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-10698':12A,15A '-2025':11A,14A '1.8':27B,88C '25.2':29B,90C '64':75C 'access':45B 'affect':84C 'allow':77C 'attack':43B 'bit':76C 'build':40B 'configur':41B,65C 'consol':3A,18B,25B,70C,86C 'cve':10A,13A 'data':9A,54B,81C 'default':4A,33B,56C 'embed':7A,52B,79C 'expos':6A 'ident':2A,17B,24B,69C,85C 'identity-consol':16B 'incorrect':32B,55C 'instal':48B 'issu':83C 'linux':19B,73C 'non':38B,63C 'non-releas':37B,62C 'opentext':1A,20B,23B,68C 'permiss':5A,34B,57C 'product':49B,59C 'releas':39B,60C,64C 'retriev':51B,78C 'sensit':8A,53B,80C 'ship':30B 'vendor':21B 'version':26B 'vulner':66C 'window':22B,72C","nicknames":[],"mitigations":[],"who_affected":"Organizations running OpenText Identity Console on Windows, Linux, or 64-bit systems in versions 1.8 through 25.2. The sources do not state which deployment or configuration choices make an install exposed, so the full scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identityconsole","linux","medium","opentext","vendor","windows"],"campaign_type":null,"search_a":"'-10698':12A,15A '-2025':11A,14A 'consol':3A 'cve':10A,13A 'data':9A 'default':4A 'embed':7A 'expos':6A 'ident':2A 'opentext':1A 'permiss':5A 'sensit':8A","search_b":"'1.8':27B '25.2':29B 'access':45B 'attack':43B 'build':40B 'configur':41B 'consol':18B,25B 'data':54B 'default':33B 'embed':52B 'ident':17B,24B 'identity-consol':16B 'incorrect':32B 'instal':48B 'linux':19B 'non':38B 'non-releas':37B 'opentext':20B,23B 'permiss':34B 'product':49B 'releas':39B 'retriev':51B 'sensit':53B 'ship':30B 'vendor':21B 'version':26B 'window':22B","search_c":"'1.8':88C '25.2':90C '64':75C 'affect':84C 'allow':77C 'bit':76C 'configur':65C 'consol':70C,86C 'data':81C 'default':56C 'embed':79C 'ident':69C,85C 'incorrect':55C 'issu':83C 'linux':73C 'non':63C 'non-releas':62C 'opentext':68C 'permiss':57C 'product':59C 'releas':60C,64C 'retriev':78C 'sensit':80C 'vulner':66C 'window':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T17:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber","cvss_by":"security@opentext.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-10698","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10698","severity":null,"published_at":"2026-11-12T17:17:20+00:00","modified_at":"2026-11-12T17:17:20+00:00","first_seen_at":"2026-11-12T17:39:37+00:00","fetched_at":"2026-11-12T17:39:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}