Home » Database

AVID-2026-R1648

Description

Improper Access Control vulnerability in EmbedAI (CVE-2025-0744)

Details

an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the “/demos/embedai/pmt_cash_on_delivery/pay” endpoint.

Reason for inclusion in AVID: The CVE describes an improper access control vulnerability in an AI-related software product (EmbedAI), which is a component that could be used in AI pipelines or deployments. As a vulnerability in a software product used to build/deploy AI systems, it affects the AI supply chain (dependencies/runtimes/model-serving stacks). It is a security/safety vulnerability, and the report provides CVE details and references, supporting evidence.

References

Affected or Relevant Artifacts

  • Developer: EmbedAI
  • Deployer: EmbedAI
  • Artifact Details:
TypeName
SystemEmbedAI

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score7.5
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity Impact🔴 High
Availability ImpactNONE

CWE

IDDescription
CWE-284CWE-284: Improper Access Control

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-01-30
  • Version: 0.3.3
  • AVID Entry