CVE-2025-46552 KHC-INVITATION-AUTOMATION Sensitive User Information Leakage in Invitation Automation
Unauthorized users can access sensitive email and Discord data via exposed API endpoints in the KHC-INVITATION-AUTOMATION script.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-46552?
CVE-2025-46552 is a medium-severity vulnerability in Krypto-Hashers-Community KHC-INVITATION-AUTOMATION, published on 29 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on version 1.2, a vulnerability was identified where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed unauthorized users to access sensitive user information by directly calling specific endpoints. This issue has been patched in a later commit on version 1.2.
Which versions are affected by CVE-2025-46552?
How do I fix CVE-2025-46552?
No fix has been published for CVE-2025-46552 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-46552 being exploited?
There is no known exploitation of CVE-2025-46552 in the wild and no public exploit code.