{"id":"GHSA-ww28-4m4v-cq4j","aliases":["CVE-2025-49652","PYSEC-2026-290"],"title":"BackendAI Missing Authentication for Critical Function","description":"Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.","severity":"critical","score":9.8,"published":"2025-06-09T18:32:17.000Z","modified":"2026-10-27T15:30:03.251Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"backend-ai","ranges":[{"events":[{"introduced":"0"},{"fixed":"25.15.6"}],"type":"ECOSYSTEM"}],"versions":["1.0.0","1.0.1","1.0.2","1.1.0","1.2.0","1.3.0","1.4.0","18.12.0","19.3.0","19.3.0a1","19.9.0","20.3.0","20.3.1","20.9.0","20.9.0a1.dev0","21.3.0","22.3.0"],"fixed":["25.15.6"]},{"ecosystem":"PyPI","name":"backend-ai","ranges":[{"events":[{"introduced":"25.16.0rc1"},{"fixed":"25.19.0rc1"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["25.19.0rc1"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-49652","https://github.com/lablup/backend.ai/commit/37fc8f70f9bad2dd01fe2e288f9006e96f9914ed","https://github.com/lablup/backend.ai/commit/b6d3ddd9e285a7ce59722a37585b9298681eb82f","https://github.com/lablup/backend.ai/commit/d7704f506e319acff205d91bfca6e2ca92939983","https://github.com/lablup/backend.ai","https://github.com/pypa/advisory-database/tree/main/vulns/backend-ai/PYSEC-2026-290.yaml","https://hiddenlayer.com/sai_security_advisor/2025-05-backendai-49653","https://hiddenlayer.com/sai_security_advisor/2025-06-backendai","https://pypi.org/project/backend-ai"],"sources":[{"name":"OSV","id":"GHSA-ww28-4m4v-cq4j","modified":"2026-10-27T15:30:03.251653767Z","url":"https://osv.dev/vulnerability/GHSA-ww28-4m4v-cq4j"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8}]}