tgstation-server is a production scale tool for BYOND server management

CVE-2025-21611 is an authorization bug in tgstation-server where the global enabled user check was combined with per-action roles using OR logic instead of AND. In affected versions >= 6.11.0, < 6.12.3, any already-enabled account can reach most API actions even when its assigned rights should block them. The vendor explicitly notes WriteUsers is unaffected, so the bug does not let a low-privileged user permanently rewrite their own account permissions.

The vendor's HIGH 8.8 score is technically defensible in CVSS terms because exploitation is remote and low-complexity once you have an account. In real operations, though, the decisive friction is that this is not initial access: the attacker must already possess a valid, enabled TGS identity in a niche server-management product with limited enterprise exposure. That makes this a meaningful authz failure, but not the sort of internet-scale emergency the raw CVSS suggests.

Why this verdict

• Dropped for attacker position: vendor CVSS starts from PR:L, which in real life means the attacker already has a valid, enabled account in the application. That is a post-auth control failure, not internet-scale initial access.
• Dropped for population: tgstation-server is a specialized BYOND server-management product, not a broadly deployed enterprise staple. Narrow deployment base means lower campaign utility and lower expected opportunistic exploitation.
• Dropped for durability limits: the advisory explicitly says WriteUsers is unaffected, so the attacker cannot use this bug alone to permanently rewrite their account rights. That trims the persistence and administrative finality of the escalation.
• Held above LOW because impact is still broad once inside: the bug opens access to most authorized API actions, and the public issue shows a real rights bypass on /Repository. On a live TGS instance, that can translate into material confidentiality, integrity, and availability impact.
• Held below HIGH because there is no exploitation pressure: no KEV listing, no public campaign evidence, no public exploit kit, and a very low EPSS all push this out of the urgent queue.

Why not higher?

Because every exploit chain starts with an already-authenticated, enabled TGS user, this vulnerability assumes a prior compromise stage or an insider. That prerequisite sharply narrows reachable population and should be treated as compounding downward pressure on severity. The lack of public exploitation evidence and the product's niche footprint remove the urgency you would expect from a truly high-priority remote admin-plane bug.

Why not lower?

This is still not harmless. The flaw collapses permission boundaries for most API actions inside a server-management plane, which is exactly the kind of place where low-privileged users should never get broad operational reach. If your TGS deployment is shared among moderators, content managers, or junior operators, the practical blast radius is too meaningful to dismiss as backlog noise.

1. Restrict API reachability — Put the TGS API behind VPN, bastion, or tightly scoped reverse-proxy ACLs so only operator networks can reach it. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but if your TGS endpoint is internet-accessible, do this immediately anyway because it shrinks the attacker pool to insiders and already-authorized admins.
2. Disable unnecessary enabled users — The bug only works for accounts that are both valid and enabled, and the vendor workaround says to disable users that should not have full access. Prune stale local users, shared accounts, and dormant service identities during the normal remediation window.
3. Review low-privileged instance users — Audit who has any instance access at all, especially accounts intended to have narrow repo or job permissions. For a MEDIUM issue there is no noisgate mitigation deadline, but rights cleanup is worth doing before the eventual patch because it removes the exact exploitation substrate.
4. Alert on non-admin API use of admin-like endpoints — Create detections for low-privileged or rarely used accounts hitting repository, compile, config, or instance-management endpoints. This gives you visibility during the 365-day remediation window and helps catch both abuse of this CVE and ordinary credential misuse.

Run this from an auditor workstation or the target host. Preferred invocation is against the unauthenticated TGS root endpoint documented as GET /: python3 tgs_cve_2025_21611_check.py --url http://tgs.example:5000. No elevated privileges are required; alternatively pass a known version directly with --version 6.12.2.

#!/usr/bin/env python3
# CVE-2025-21611 checker for tgstation-server
# Usage:
#   python3 tgs_cve_2025_21611_check.py --url http://tgs.example:5000
#   python3 tgs_cve_2025_21611_check.py --version 6.12.2
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

import argparse
import json
import re
import sys
import urllib.request
import urllib.error

AFFECTED_MIN = (6, 11, 0)
PATCHED_MIN = (6, 12, 3)


def parse_version(text):
    if text is None:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)(?:\.(\d+))?', str(text))
    if not m:
        return None
    return tuple(int(x) for x in m.groups(default='0'))


def cmp_ver(a, b):
    maxlen = max(len(a), len(b))
    a = a + (0,) * (maxlen - len(a))
    b = b + (0,) * (maxlen - len(b))
    if a < b:
        return -1
    if a > b:
        return 1
    return 0


def classify(ver):
    if cmp_ver(ver, AFFECTED_MIN) >= 0 and cmp_ver(ver, PATCHED_MIN) < 0:
        return 'VULNERABLE'
    if cmp_ver(ver, PATCHED_MIN) >= 0:
        return 'PATCHED'
    return 'PATCHED'


def fetch_version_from_url(base_url, timeout=8):
    url = base_url.rstrip('/') + '/'
    req = urllib.request.Request(url, headers={'User-Agent': 'noisgate-cve-check/1.0', 'Accept': 'application/json'})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        raw = resp.read().decode('utf-8', errors='replace')
        try:
            data = json.loads(raw)
        except json.JSONDecodeError:
            return None, f'Non-JSON response from {url}'
        if isinstance(data, dict):
            version = data.get('version')
            if version:
                return str(version), None
            return None, f'JSON response from {url} did not contain a version field'
        return None, f'Unexpected JSON structure from {url}'


def main():
    parser = argparse.ArgumentParser(description='Check tgstation-server for CVE-2025-21611 exposure by version.')
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument('--url', help='Base URL of the tgstation-server API, e.g. http://host:5000')
    group.add_argument('--version', help='Known tgstation-server version string, e.g. 6.12.2')
    args = parser.parse_args()

    version_text = None

    if args.url:
        try:
            version_text, err = fetch_version_from_url(args.url)
            if err:
                print(f'UNKNOWN - {err}')
                sys.exit(2)
        except urllib.error.HTTPError as e:
            print(f'UNKNOWN - HTTP error querying {args.url}: {e.code} {e.reason}')
            sys.exit(2)
        except urllib.error.URLError as e:
            print(f'UNKNOWN - Network error querying {args.url}: {e.reason}')
            sys.exit(2)
        except Exception as e:
            print(f'UNKNOWN - Unexpected error querying {args.url}: {e}')
            sys.exit(2)
    else:
        version_text = args.version

    ver = parse_version(version_text)
    if ver is None:
        print(f'UNKNOWN - Could not parse version from input: {version_text}')
        sys.exit(2)

    status = classify(ver)
    normalized = '.'.join(str(x) for x in ver[:4]).rstrip('.0') if len(ver) > 3 else '.'.join(str(x) for x in ver)

    if status == 'VULNERABLE':
        print(f'VULNERABLE - tgstation-server version {normalized} is within affected range >= 6.11.0 and < 6.12.3')
        sys.exit(1)
    elif status == 'PATCHED':
        print(f'PATCHED - tgstation-server version {normalized} is not within the affected range for CVE-2025-21611')
        sys.exit(0)

    print('UNKNOWN - Unable to determine status')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. GitHub Security Advisory GHSA-rf5r-q276-vrc4
2. Fix commit e7b1189
3. Public issue #2064 reproduction details
4. NVD CVE-2025-21611
5. tgstation-server API documentation
6. tgstation-server product documentation
7. CISA Vulnerability Summary for the Week of January 6, 2025
8. FIRST EPSS API documentation