Get real-time updates on Telegram
P4Verified
CVE-2025-49652: BackendAI * to before 25.15.6
CVE-2025-49652. CVSS 3.1 base score 9.8 (CRITICAL, Source advisory). EPSS 0.00427 (percentile 0.3521), scored 13-Oct-2026.
Affected technology
BackendAI · * to before 25.15.6
Lablup
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required
What an attacker can do
Arbitrary users can create user accounts that can access private data even when registration is disabled. Source advisory’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-306
- CCR priority
- 39.3 /100 (P4)
- CVSS 3.1
- 9.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · Source advisory
- EPSS
- 0.00427 · percentile 0.3521 · 2026-10-13
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-15 01:07:31.726917+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2025-49652.html