{"id":"CVE-2025-49652","summary":"Improper access control allows arbitrary account creation","details":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","aliases":["GHSA-ww28-4m4v-cq4j","PYSEC-2026-290"],"modified":"2026-10-16T02:31:20.342863586Z","published":"2025-06-09T17:26:20.835Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49652.json","cna_assigner":"HiddenLayer","cwe_ids":["CWE-306"]},"references":[{"type":"WEB","url":"https://hiddenlayer.com/sai_security_advisor/2025-06-backendai/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49652.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49652"},{"type":"PACKAGE","url":"https://github.com/lablup/backend.ai"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lablup/backend.ai","events":[{"introduced":"0"},{"fixed":"08248fb7a3cf89d4084c008cd22854044e0194ea"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"*"},{"fixed":"25.15.6"}]}}],"versions":["25.15.5","25.15.4","25.15.3","25.15.2","25.15.1","25.15.0","25.15.0rc1","25.14.5","25.14.4","25.14.3","25.14.2","25.14.1","25.14.0","25.14.0rc1","25.13.4","25.13.3","25.13.2","25.13.1","25.13.0","25.12.1","25.12.0","25.11.0","25.10.1","25.10.0","25.9.1","25.9.0","25.8.1","25.8.0","25.6.3","25.7.0","25.6.2","25.6.1","25.6.0","25.5.2","25.5.1","25.5.0","25.4.0","25.3.2","25.3.3","25.3.1","25.3.1rc1","25.3.0","25.2.0","25.3.0rc1","25.1.1","25.1.0","24.12.1","24.12.0","24.09.0b1","24.03.0rc1","24.03.0b1","24.03.0a2","24.03.0a1","23.09.0","23.09.0b3","23.09.0b2","23.09.0b1","23.09.0a4","23.09.0a3","23.09.0a2","23.09.0a1","23.03.4","23.03.3","23.03.2","23.03.1","23.03.0","23.03.0a4","23.03.0a3","23.03.0a2","23.03.0a1","22.09.6","22.09.5","22.09.4","22.09.3","22.09.2","22.09.1","22.09.0","22.09.0b6","22.09.0b5","22.09.0b4","22.09.0b3","22.09.0b2","22.09.0b1","22.06.0b4","22.06.0b2","22.06.0b1","22.06.0.dev4","22.06.0.dev3","22.03.0","21.09.0","21.03.0","20.09.0","20.09.0a1","19.03.0","18.12.0","1.2.0","1.1.0","1.0.2","api-v2.20170315","api-v1.20160915","v0.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-49652.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}