HIGH
Improper Access Control vulnerability in EmbedAI
Published Jan 30, 2025
8.6
HIGHCVSS 3.1
EPSS 0.34%
Description
An Improper Access Control vulnerability has been found in EmbedAI
2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages belonging to other users by changing the “CHAT_ID” of the endpoint "/embedai/chats/load_messages?chat_id=<CHAT_ID>".
Affected products
-
Affected
- ≥ 0, < 2.1
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
Vendor solution
The vulnerability has been resolved by EmbedAI team in version 2.1.
Weaknesses (1)
References (2)
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1844 Advisory
- https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai Third Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1844 | Advisory | |
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai | Third Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner INCIBE
Published Jan 30, 2025
Updated Jan 30, 2025
Reserved Jan 27, 2025
Link CVE-2025-0740
CISA Vulnrichment
Updated Jan 30, 2025
Red Hat
No data
GitHub
No data