GHSA-ww28-4m4v-cq4j

Source

https://github.com/advisories/GHSA-ww28-4m4v-cq4j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-ww28-4m4v-cq4j/GHSA-ww28-4m4v-cq4j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-ww28-4m4v-cq4j

Aliases

CVE-2025-49652

Published

2025-06-09T18:32:17Z

Modified

2026-02-03T02:59:44.322344Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

BackendAI Missing Authentication for Critical Function

Details

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

Database specific

{
    "cwe_ids": [
        "CWE-306"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-11T17:37:45Z",
    "nvd_published_at": "2025-06-09T18:15:26Z",
    "severity": "CRITICAL"
}

References

Affected packages

PyPI / backend-ai

Package

Name: backend-ai; View open source insights on deps.dev
Purl: pkg:pypi/backend-ai

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

25.15.6

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.1.0

1.2.0

1.3.0

1.4.0

18.*

18.12.0

19.*

19.3.0a1

19.3.0

19.9.0

20.*

20.3.0

20.3.1

20.9.0a1.dev0

20.9.0

21.*

21.3.0

22.*

22.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-ww28-4m4v-cq4j/GHSA-ww28-4m4v-cq4j.json"

PyPI / backend-ai

Package

Name: backend-ai; View open source insights on deps.dev
Purl: pkg:pypi/backend-ai

Affected ranges

Type: ECOSYSTEM
Events: Introduced

25.16.0rc1

Fixed

25.19.0rc1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-ww28-4m4v-cq4j/GHSA-ww28-4m4v-cq4j.json"