{"id":"CVE-2025-49652","title":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","summary":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-306"],"published":"2025-06-09","updated":"2026-10-14","sourceUpdated":"2026-10-14T17:17:41.777","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-49652","references":[{"url":"https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/","label":"6f8de1f0-f67e-45a6-b68f-98777fdb759c"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49652"},{"url":"https://hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653"},{"url":"https://hiddenlayer.com/sai_security_advisor/2025-06-backendai"},{"url":"https://github.com/lablup/backend.ai/commit/37fc8f70f9bad2dd01fe2e288f9006e96f9914ed"},{"url":"https://github.com/lablup/backend.ai/commit/b6d3ddd9e285a7ce59722a37585b9298681eb82f"},{"url":"https://github.com/lablup/backend.ai/commit/d7704f506e319acff205d91bfca6e2ca92939983"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/backend-ai/PYSEC-2026-290.yaml"},{"url":"https://pypi.org/project/backend-ai"},{"url":"https://github.com/advisories/GHSA-ww28-4m4v-cq4j"},{"url":"https://github.com/lablup/backend.ai"}],"tags":["nvd","cve.org","exploit-available","ghsa","pip","osv"],"epss":0.00427,"epssPercentile":0.36791,"ingestedAt":"2026-10-14T17:44:53.602Z","vendor":"Lablup","product":"BackendAI","affected":["BackendAI < 25.15.6"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2025-06-09T18:51:21.168801Z"},"aliases":["GHSA-ww28-4m4v-cq4j","PYSEC-2026-290"],"ecosystem":"pip","patched":["backend.ai 25.15.6","backend.ai 25.19.0rc1"],"slug":"CVE-2025-49652","body":"## Overview\n\nMissing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2025-49652)\n\nAffected packages:\n\n- `backend.ai < 25.15.6`\n- `backend.ai >= 25.16.0rc1, < 25.19.0rc1`\n\nPatched in:\n\n- `backend.ai 25.15.6`\n- `backend.ai 25.19.0rc1`\n\nSource: https://github.com/advisories/GHSA-ww28-4m4v-cq4j","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":221373,"id":"CVE-2025-49652","ts":1792031161056,"field":"exploit_available","old":"false","new":"true"}]}