lablup/backend.ai · Security
BackendAI Missing Authentication for Critical Function
- GHSA ID
- GHSA-ww28-4m4v-cq4j
- CVE ID
- CVE-2025-49652
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
CWEs
- CWE-306 · Missing Authentication for Critical Function
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-49652 ↗
- https://hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653 ↗
- https://hiddenlayer.com/sai_security_advisor/2025-06-backendai ↗
- https://github.com/lablup/backend.ai/commit/37fc8f70f9bad2dd01fe2e288f9006e96f9914ed ↗
- https://github.com/lablup/backend.ai/commit/b6d3ddd9e285a7ce59722a37585b9298681eb82f ↗
- https://github.com/lablup/backend.ai/commit/d7704f506e319acff205d91bfca6e2ca92939983 ↗
- https://github.com/advisories/GHSA-ww28-4m4v-cq4j ↗