{"id":"CVE-2025-49652","kind":"vulnerability","aliases":["CVE-2025-49652","GHSA-ww28-4m4v-cq4j"],"related":[],"title":"BackendAI Missing Authentication for Critical Function","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","summary":"Backend.AI's registration feature lacks an authentication check, so any person can create a user account. Those accounts can reach private data even when the operator has turned registration off.","severity":"critical","cvss":9.8,"epss":0.00427,"exploited":false,"exploited_at":null,"products":[{"name":"backend.ai","fixed":["25.15.6"],"affected":"< 25.15.6","ecosystem":"pypi"},{"name":"backend.ai","fixed":["25.19.0rc1"],"affected":">= 25.16.0rc1, < 25.19.0rc1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["backend.ai","cwe-306","package","python","self-hosted"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed version of the `backend.ai` package with `pip show backend.ai` and compare it with the fixed versions below.\n- Confirm whether registration is enabled on the deployment; the sources do not name the exact setting, so unknown.","fix":"- Upgrade `backend.ai` to `25.15.6` on the 25.15 line, or to `25.19.0rc1` on the 25.16 to 25.19 range.\n- Review user accounts created recently for ones you did not authorise, since registration may have been reachable.","status":"open","published_at":"2025-06-09T18:15:26+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","triaged_at":"2026-10-27T15:18:56+00:00","updated_at":"2026-10-27T15:32:59+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T15:18:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `backend.ai` to `25.15.6` on the 25.15 line, or to `25.19.0rc1` on the 25.16 to 25.19 range.\n- Review user accounts created recently for ones you did not authorise, since registration may have been reachable.","reach":"internet","title":"Backend.AI: missing authentication lets anyone create accounts and read private data","impact":"high","summary":"Backend.AI's registration feature lacks an authentication check, so any person can create a user account. Those accounts can reach private data even when the operator has turned registration off.","category":"package","nicknames":[],"who_cares":["backend.ai","python","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Anyone creates an account and reads private data.","analyst_note":"Check the GHSA-ww28-4m4v-cq4j advisory for the exact configuration that exposes the registration path and whether a disabled-registration setting is bypassed.","how_to_check":"- Check the installed version of the `backend.ai` package with `pip show backend.ai` and compare it with the fixed versions below.\n- Confirm whether registration is enabled on the deployment; the sources do not name the exact setting, so unknown.","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Deployments of the Backend.AI platform from pypi package backend.ai that run a version before 25.15.6, or from 25.16.0rc1 before 25.19.0rc1. The sources do not say which configurations are exposed beyond the registration feature, so the exact exposure is unknown. Teams that run a patched release or do not run Backend.AI can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00064,"input_tokens":3356,"output_tokens":609,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':8A,16A '-306':22B '-49652':9A,17A '4m4v':13A 'access':76C 'account':43B,45B,73C 'allow':67C 'arbitrari':68C 'authent':3A,34B,58C 'backend.ai':18A,19A,20B,28B 'backendai':1A,66C 'check':35B 'cq4j':14A 'creat':40B,71C 'critic':5A 'cve':7A,15A 'cwe':21B 'data':49B,78C 'disabl':83C 'even':50B,79C 'featur':31B,62C 'function':6A 'ghsa':11A 'ghsa-ww28-4m4v-cq4j':10A 'host':27B 'lablup':64C 'lack':32B 'miss':2A,57C 'oper':53B 'packag':23B 'person':38B 'privat':48B,77C 'python':24B 'reach':47B 'registr':30B,56B,61C,81C 'self':26B 'self-host':25B 'turn':55B 'user':42B,69C,72C 'ww28':12A","nicknames":[],"mitigations":[],"who_affected":"Deployments of the Backend.AI platform from pypi package backend.ai that run a version before 25.15.6, or from 25.16.0rc1 before 25.19.0rc1. The sources do not say which configurations are exposed beyond the registration feature, so the exact exposure is unknown. Teams that run a patched release or do not run Backend.AI can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-06-09T18:15:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-ww28-4m4v-cq4j","url":"https://github.com/advisories/GHSA-ww28-4m4v-cq4j","severity":"critical","published_at":"2025-06-09T18:32:17+00:00","modified_at":"2026-10-27T15:15:53+00:00","first_seen_at":"2026-10-27T15:18:30+00:00","fetched_at":"2026-10-27T15:18:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-49652","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49652","severity":null,"published_at":"2025-06-09T18:15:26+00:00","modified_at":"2026-10-14T17:17:41+00:00","first_seen_at":"2026-10-27T15:32:59+00:00","fetched_at":"2026-10-27T15:32:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}