CVE-2025-0741 MEDIUM

CVE-2025-0741: Improper Access Control vulnerability in EmbedAI

Vendor Embedai

Product EmbedAI

Weakness CWE-284

Published January 30, 2025

Last update February 18, 2025

View on NVD All CVEs

CVSS base score

5.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

What the vulnerability does

01Description

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chat_id" of the POST request "/embedai/chats/send_message".

Key dates

02Disclosure timeline

January 30, 2025 CVE published

February 18, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-0741 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html

Related vulnerabilities

04Related CVE

CVE-2023-24486 Local user access to a system where another user is utilizing a vulnerable version of Citrix Workspace App for Linux to launch published desktops and applications CVE-2022-28778 CVE-2026-35172 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation CVE-2026-9604 JeecgBoot AiragModelController access control CVE-2025-59512 Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability