Threat database

Exposure of sensitive data in active sessions in Lablup's BackendAI allows attackers to retrieve credentials for users on the management platform.

CVE-2025-49652 is a critical vulnerability in Lablup's BackendAI where the registration feature lacks authentication controls. This flaw allows any arbitrary user to create accounts and gain access to private data, even if registration is supposed to be disabled. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI.