CVE-2025-49652

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-49652
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49652.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-49652
Aliases
Published
2025-06-09T17:26:20Z
Modified
2026-10-16T02:31:20Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Improper access control allows arbitrary account creation
Details

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

Database specific 
{
    "cna_assigner":  "HiddenLayer",
    "cwe_ids":  [
        "CWE-306"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49652.json"
}
References

Affected packages

Git / github.com/lablup/backend.ai

Affected ranges

Type
GIT
Repo
https://github.com/lablup/backend.ai
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
08248fb7a3cf89d4084c008cd22854044e0194ea
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "*"
        },
        {
            "fixed":  "25.15.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.2
1.1.0
1.2.0
18.*
18.12.0
19.*
19.03.0
20.*
20.09.0
20.09.0a1
21.*
21.03.0
21.09.0
22.*
22.03.0
22.06.0.dev3
22.06.0.dev4
22.06.0b1
22.06.0b2
22.06.0b4
22.09.0
22.09.0b1
22.09.0b2
22.09.0b3
22.09.0b4
22.09.0b5
22.09.0b6
22.09.1
22.09.2
22.09.3
22.09.4
22.09.5
22.09.6
23.*
23.03.0
23.03.0a1
23.03.0a2
23.03.0a3
23.03.0a4
23.03.1
23.03.2
23.03.3
23.03.4
23.09.0
23.09.0a1
23.09.0a2
23.09.0a3
23.09.0a4
23.09.0b1
23.09.0b2
23.09.0b3
24.*
24.03.0a1
24.03.0a2
24.03.0b1
24.03.0rc1
24.09.0b1
24.12.0
24.12.1
25.*
25.1.0
25.1.1
25.10.0
25.10.1
25.11.0
25.12.0
25.12.1
25.13.0
25.13.1
25.13.2
25.13.3
25.13.4
25.14.0
25.14.0rc1
25.14.1
25.14.2
25.14.3
25.14.4
25.14.5
25.15.0
25.15.0rc1
25.15.1
25.15.2
25.15.3
25.15.4
25.15.5
25.2.0
25.3.0
25.3.0rc1
25.3.1
25.3.1rc1
25.3.2
25.3.3
25.4.0
25.5.0
25.5.1
25.5.2
25.6.0
25.6.1
25.6.2
25.6.3
25.7.0
25.8.0
25.8.1
25.9.0
25.9.1
api-v1.*
api-v1.20160915
api-v2.*
api-v2.20170315
v0.*
v0.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49652.json"