AVID-2026-R1648
Description
Improper Access Control vulnerability in EmbedAI (CVE-2025-0744)
Details
an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the “/demos/embedai/pmt_cash_on_delivery/pay” endpoint.
Reason for inclusion in AVID: The CVE describes an improper access control vulnerability in an AI-related software product (EmbedAI), which is a component that could be used in AI pipelines or deployments. As a vulnerability in a software product used to build/deploy AI systems, it affects the AI supply chain (dependencies/runtimes/model-serving stacks). It is a security/safety vulnerability, and the report provides CVE details and references, supporting evidence.
References
Affected or Relevant Artifacts
- Developer: EmbedAI
- Deployer: EmbedAI
- Artifact Details:
| Type | Name |
|---|---|
| System | EmbedAI |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| Base Score | 7.5 |
| Base Severity | 🔴 High |
| Attack Vector | NETWORK |
| Attack Complexity | 🟢 Low |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | 🔴 High |
| Availability Impact | NONE |
CWE
| ID | Description |
|---|---|
| CWE-284 | CWE-284: Improper Access Control |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2025-01-30
- Version: 0.3.3
- AVID Entry