CVE-2025-46552 MEDIUM

CVE-2025-46552: KHC-INVITATION-AUTOMATION Sensitive User Information Leakage in Invitation Automation

Vendor Krypto-Hashers-Community
Product KHC-INVITATION-AUTOMATION
Weakness CWE-200 · Info exposure
Published April 29, 2025
Last update April 30, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on version 1.2, a vulnerability was identified where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed unauthorized users to access sensitive user information by directly calling specific endpoints. This issue has been patched in a later commit on version 1.2.

Key dates

02Disclosure timeline

April 29, 2025 CVE published
April 30, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2021-31371 Junos OS: QFX5000 Series: Traffic from the network internal to the device (128.0.0.0) may be forwarded to egress interfaces. CVE-2022-43868 IBM Security Verify Access information disclosure CVE-2023-30740 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform CVE-2023-49877 IBM System Storage Virtualization Engine information disclosure CVE-2025-24360 Opening a malicious website while running a Nuxt dev server could allow read-only access to code