Description

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by others users by changing the "FILE_ID" of the endpoint "/embedai/files/show/".

Classification

CVE ID: CVE-2025-0742

CVSS Base Severity: MEDIUM

CVSS Base Score: 5.8

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Affected Products

Vendor: EmbedAI

Product: EmbedAI

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 11.77% (scored less or equal to compared to others)

EPSS Date: 2025-02-28 (when was this score calculated)

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai

Timeline