CVE-2025-0739

Improper Access Control vulnerability in EmbedAI

CVSS 8.6 HIGHEPSS 0.3%CWE-284

Vexday Risk Score

21Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 8.6EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

30 ene 2025Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's information of others users by changing the "SUSCBRIPTION_ID" param of the endpoint "/demos/embedai/subscriptions/show/<SUSCBRIPTION_ID>".

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Productos afectados

EmbedAI · EmbedAI

Referencias

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai