GitHub Advisoryadvisory · PyPI

GHSA-ww28-4m4v-cq4j BackendAI Missing Authentication for Critical Function

CRITICAL Published 2025-06-09 Modified 2026-10-27 Official page ↗
Aliases
CVE-2025-49652
Ecosystem
PyPI
Packages
backend.ai
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306
Reviewed
2025-06-11

Affected packages

• PyPI backend.ai: < 25.15.6 → fixed in 25.15.6 • PyPI backend.ai: >= 25.16.0rc1, < 25.19.0rc1 → fixed in 25.19.0rc1

Description

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

Related

Alias · CVE (1)

  • CVE-2025-49652 Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access… vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References