CVE-2025-0739
📋 TL;DR
An Improper Access Control vulnerability in EmbedAI 2.1 and earlier allows authenticated attackers to view other users' subscription information by manipulating the SUSCBRIPTION_ID parameter. This affects all deployments running vulnerable versions of EmbedAI. The vulnerability enables unauthorized access to sensitive subscription data.
💻 Affected Systems
- EmbedAI
📦 What is this software?
Embedai by Thesamur
⚠️ Risk & Real-World Impact
Worst Case
Attackers could enumerate all subscription data, potentially exposing billing information, user details, and service usage patterns across the entire user base.
Likely Case
Authenticated users accessing subscription details of other users they shouldn't have permission to view, leading to data privacy violations.
If Mitigated
With proper access controls, users can only view their own subscription information, preventing unauthorized data access.
🎯 Exploit Status
Requires authenticated access but exploitation is straightforward via parameter manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: EmbedAI version after 2.1
Vendor Advisory: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-embedai
Restart Required: No
Instructions:
1. Upgrade EmbedAI to version after 2.1. 2. Verify the patch implements proper access control checks on the /demos/embedai/subscriptions/show/ endpoint.
🔧 Temporary Workarounds
Endpoint Access Restriction
allTemporarily restrict access to the vulnerable endpoint using web server or application firewall rules.
🧯 If You Can't Patch
- Implement application-level access control checks to verify users can only access their own subscription IDs
- Monitor for suspicious access patterns to the subscriptions endpoint
🔍 How to Verify
Check if Vulnerable:
Test if authenticated users can access other users' subscription data by modifying the SUSCBRIPTION_ID parameter in requests to /demos/embedai/subscriptions/show/Check Version:
Check EmbedAI version in application interface or configuration filesVerify Fix Applied:
Verify that modifying the SUSCBRIPTION_ID parameter no longer allows access to other users' subscription information📡 Detection & Monitoring
Log Indicators:
- Multiple failed access attempts to different subscription IDs from same user
- Rapid sequential requests to /demos/embedai/subscriptions/show/ with different IDs
Network Indicators:
- Unusual patterns of GET requests to subscription endpoint with varying ID parameters
SIEM Query:
source="web_logs" AND uri="/demos/embedai/subscriptions/show/*" | stats count by src_ip, uri