Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2025-49652

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

VectorNETWORK

PublishedJun 09, 2025, 18:15

Published By6f8de1f0-f67e-45a6-b68f-98777fdb759c

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

backend.ai(PyPI)025.15.6N/A

backend.ai(PyPI)25.16.0rc125.19.0rc1N/A

References

https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/

Weakness Type

CWE-306

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK