CVE-2025-0741 - Improper Access Control vulnerability in EmbedAI

Back Back to CVE browser

MEDIUM

Improper Access Control vulnerability in EmbedAI

Published Jan 30, 2025

5.8

MEDIUM

CVSS 3.1

EPSS 0.24%

Description

An Improper Access Control vulnerability has been found in EmbedAI

2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chat_id" of the POST request "/embedai/chats/send_message".

Affected products

Vendor EmbedAI Product EmbedAI Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

EmbedAI

unaffected

Version	Status	Constraints
0	affected	<2.1

Remediation

Vendor solution

The vulnerability has been resolved by EmbedAI team in version 2.1.

Weaknesses (1)

CWE-284

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1845
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1845		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai		Third Party Advisory