CVE-2025-13432 Details
Description
Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the alteration of infrastructure if a subsequent plan operation is approved by a user with approval permission or auto-applied. This vulnerability, CVE-2025-13432, is fixed in Terraform Enterprise version 1.1.1 and 1.0.3.
A vulnerability exists in Terraform Enterprise versions prior to 1.1.1 and 1.0.2, allowing users with limited permissions to create new Terraform state versions in a workspace. This could lead to unauthorized changes in infrastructure if the new state version is applied, either automatically or with approval from a user who has the necessary permissions. The issue arises from a combination of workspace and organizational permissions that, when held by a user, enable them to overwrite state versions without proper write access.
Users are advised to upgrade to Terraform Enterprise versions 1.1.1 or 1.0.3.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://discuss.hashicorp.com/t/hcsec-2025-34-terraform-enterprise-state-versions-can-be-created-by-users-without-sufficient-write-access/76821 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hashicorp terraform | >= 1.0.0, < 1.0.3 1.1.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 10, 2025 | Initial Analysis | [email protected] |
| Nov 21, 2025 | New CVE Received | [email protected] |