CVE-2025-55795 Business logic in n/a
An attacker can lock out other users by stealing their email addresses due to flawed verification logic in the OpenML web application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-55795?
CVE-2025-55795 is a low-severity vulnerability in n/a, published on 29 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with a higher user ID without proper verification. This results in the victim's email being reassigned to the attacker's account, causing the victim to be locked out immediately and unable to log in. The vulnerability leads to denial of service via account lockout but does not grant the attacker direct access to the victim's private data.
Which versions are affected by CVE-2025-55795?
It affects 1 product.
Products include Openml Openml Frontend.
How do I fix CVE-2025-55795?
No fix has been published for CVE-2025-55795 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-55795 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-55795 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-87c5-mc8v-xf7r.