by Kastro
Paper/Archive/CVE-2025-49652

CVE-2025-49652

Lablup BackendAI — Improper access control allows arbitrary account creation

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.9.369 × 207.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

Affected

ProductAffectedFixed inSource
BackendAI< 25.15.625.15.6CNA

Scores by source

HiddenLayer (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhiddenlayer.com/sai_security_advisor/2025-06-backendai