CVE-2025-49652

Improper access control allows arbitrary account creation PUBLISHED

Description (CNA)

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

Affected (CNA)

Vendor / product	Versions
Lablup / BackendAI	affected * before 25.15.6

CWE

CWE-306

References

https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.