CVE-2025-49652
CVE-2025-49652 · Improper access control allows arbitrary account creation
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
CVSS 9.8 · Critical · EPSS 0.4% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
backendai
- Versions
- ≥ *, < 25.15.6: Affected (semver)
Update to 25.15.6
backend-ai PyPI
- Versions
- 1.0.0
- 1.0.1
- 1.0.2
- 1.1.0
- 1.2.0
- 1.3.0
- 1.4.0
- 18.12.0
- 19.3.0
- 19.3.0a1
- 19.9.0
- 20.3.0
- 20.3.1
- 20.9.0
- 20.9.0a1.dev0
- 21.3.0
- 22.3.0
- Affected ranges
- ECOSYSTEM: < 25.15.6
Update to 25.15.6
backend-ai PyPI
- Affected ranges
- ECOSYSTEM: ≥ 25.16.0rc1, < 25.19.0rc1
Update to 25.19.0rc1
backend-ai PyPI
- Versions
- 1.0.0
- 1.0.1
- 1.0.2
- 1.1.0
- 1.2.0
- 1.3.0
- 1.4.0
- 18.12.0
- 19.3.0
- 19.3.0a1
- 19.9.0
- 20.3.0
- 20.3.1
- 20.9.0
- 20.9.0a1.dev0
- 21.3.0
- 22.3.0
- Affected ranges
- ECOSYSTEM: < 25.15.6 ∪ ≥ 25.16.0rc1, < 25.19.0rc1
Update to 25.15.6; Update to 25.19.0rc1