{"id":"CVE-2025-49652","aliases":["EUVD-2025-17554","GHSA-ww28-4m4v-cq4j","PYSEC-2026-290"],"status":"published","title":"Improper access control allows arbitrary account creation","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00446,"percentile":0.39035,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2025-06-09T17:26:20Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"PyPI","package":"backend-ai","fixed_in":["25.15.6","25.19.0rc1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"backend-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.15.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"backend-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.16.0rc1"},{"fixed":"25.19.0rc1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"backend-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.15.6"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.1.0","1.2.0","1.3.0","1.4.0","18.12.0","19.3.0","19.3.0a1","19.9.0","20.3.0","20.3.1","20.9.0","20.9.0a1.dev0","21.3.0","22.3.0"]},{"source":"osv","ecosystem":"PyPI","package":"backend-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"25.16.0rc1"},{"fixed":"25.19.0rc1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"backend-ai","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"25.15.6"},{"introduced":"25.16.0rc1"},{"fixed":"25.19.0rc1"}]}],"versions":["1.0.0","1.0.1","1.0.2","1.1.0","1.2.0","1.3.0","1.4.0","18.12.0","19.3.0","19.3.0a1","19.9.0","20.3.0","20.3.1","20.9.0","20.9.0a1.dev0","21.3.0","22.3.0"]}],"products":[{"vendor":"lablup","product":"backendai"}],"references":[{"url":"https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49652","tags":["advisory"]},{"url":"https://hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653","tags":["web"]},{"url":"https://hiddenlayer.com/sai_security_advisor/2025-06-backendai","tags":["web"]},{"url":"https://github.com/lablup/backend.ai/commit/37fc8f70f9bad2dd01fe2e288f9006e96f9914ed","tags":["web"]},{"url":"https://github.com/lablup/backend.ai/commit/b6d3ddd9e285a7ce59722a37585b9298681eb82f","tags":["web"]},{"url":"https://github.com/lablup/backend.ai/commit/d7704f506e319acff205d91bfca6e2ca92939983","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/backend-ai/PYSEC-2026-290.yaml","tags":["web"]},{"url":"https://pypi.org/project/backend-ai","tags":["web","package"]},{"url":"https://github.com/advisories/GHSA-ww28-4m4v-cq4j","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49652.json","tags":["advisory"]},{"url":"https://github.com/lablup/backend.ai","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-49652","title":"Improper access control allows arbitrary account creation","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","status":"published","published":"2025-06-09T17:26:20.835Z","modified":"2026-10-14T16:13:31.206Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:32:25.186422Z"}],"euvd":[{"id":"EUVD-2025-17554","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","status":"published","published":"2025-06-09T17:26:20Z","modified":"2026-10-14T16:13:31Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:27:14.304159Z"}],"ghsa":[{"id":"GHSA-ww28-4m4v-cq4j","title":"BackendAI Missing Authentication for Critical Function","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","status":"published","published":"2025-06-09T18:32:17Z","modified":"2026-10-27T15:15:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:41:37.912288Z"}],"nvd":[{"id":"CVE-2025-49652","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","status":"published","published":"2025-06-09T18:15:26.897Z","modified":"2026-10-14T17:17:41.777Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:11:11.4244Z"}],"osv":[{"id":"CVE-2025-49652","title":"Improper access control allows arbitrary account creation","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","status":"published","published":"2025-06-09T17:26:20.835Z","modified":"2026-10-28T02:30:31.586228481Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"GHSA-ww28-4m4v-cq4j","title":"BackendAI Missing Authentication for Critical Function","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","status":"published","published":"2025-06-09T18:32:17Z","modified":"2026-10-27T15:30:03.251653767Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"PYSEC-2026-290","title":"BackendAI Missing Authentication for Critical Function","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","status":"published","published":"2026-06-29T11:50:38.33367Z","modified":"2026-07-02T13:00:06.540771639Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:56.429374Z"}]}}