Medium severity · published Jan 30, 2025
CVE-2025-0741
Improper Access Control vulnerability in EmbedAI
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
An Improper Access Control vulnerability has been found in EmbedAI
2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chat_id" of the POST request "/embedai/chats/send_message".
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
EmbedAI · EmbedAI
before 2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0741
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0741
Third Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai
More from EmbedAI
6.5
CVE-2025-0745
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0744
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0742
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0740
Improper Access Control vulnerability in EmbedAI
6.5
CVE-2025-0739
Improper Access Control vulnerability in EmbedAI