CVE-2025-0744 Improper Access Control vulnerability in EmbedAI
Authenticated attackers can bypass payment requirements to upgrade their subscription plans by manipulating API parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0744?
CVE-2025-0744 is a high-severity vulnerability in EmbedAI, published on 30 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmt_cash_on_delivery/pay" endpoint.
Weakness: CWE-284
Which versions are affected by CVE-2025-0744?
It affects 1 product.
Products include Thesamur Embedai.
How do I fix CVE-2025-0744?
No fix has been published for CVE-2025-0744 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-0744 being exploited?
There is no known exploitation of CVE-2025-0744 in the wild and no public exploit code.
Other vulnerabilities in EmbedAI
- CVE-2025-0739 Improper Access Control vulnerability in EmbedAI
- CVE-2025-0740 Improper Access Control vulnerability in EmbedAI
- CVE-2025-0747 Stored Cross-Site vulnerability in EmbedAI
- CVE-2025-0745 Improper Access Control vulnerability in EmbedAI
- CVE-2025-0746 Reflected Cross-Site Scripting vulnerability in EmbedAI
Sources
Also known as GHSA-26wm-7r96-7phx.