Improper Access Control in EmbedAI Product by EmbedAI Vendor
CVE-2025-0742

5.8MEDIUM

Key Information:

Vendor
Embedai
Status
Embedai
Vendor
CVE Published:
30 January 2025

Summary

An improper access control vulnerability has been identified in EmbedAI versions up to 2.1. This flaw enables authenticated attackers to access and retrieve files belonging to other users by manipulating the 'FILE_ID' in the endpoint '/embedai/files/show/<FILE_ID>'. Such a security breach could lead to unauthorized data exposure and privacy concerns.

Affected Version(s)

EmbedAI 0 < 2.1

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V3.1

Score:
5.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

David Utón Amaya (m3n0sd0n4ld)
.