Medium severity · published Jan 30, 2025
CVE-2025-0740
Improper Access Control vulnerability in EmbedAI
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
An Improper Access Control vulnerability has been found in EmbedAI
2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages belonging to other users by changing the “CHAT_ID” of the endpoint "/embedai/chats/load_messages?chat_id=<CHAT_ID>".
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
EmbedAI · EmbedAI
before 2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0740
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0740
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai
More from EmbedAI
6.5
CVE-2025-0745
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0744
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0742
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0739
Improper Access Control vulnerability in EmbedAI
5.4
CVE-2025-0747
Stored Cross-Site vulnerability in EmbedAI