CVE-2025-61162 in North AI
Summary
by MITRE • 08/26/2026
Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified in Cohere North AI version 1.1.5 represents a critical failure in server-side access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw resides within the internal API endpoint /api/internal/v1/users/{{USER_ID}}, which is designed to handle user profile modifications. The core technical deficiency lies in the application's inability to properly validate whether the authenticated actor initiating the request possesses the requisite administrative privileges or ownership rights over the target resource identified by the USER_ID parameter. Instead of enforcing strict authorization checks that compare the requester's identity against the subject of the modification, the system accepts and processes arbitrary write operations provided through a crafted HTTP request. This allows an attacker to bypass intended security boundaries and manipulate user data fields without restriction.
From an operational perspective, this vulnerability enables unauthorized actors to arbitrarily overwrite critical user information associated with any account in the system. The impact extends beyond simple data modification; it facilitates identity impersonation, privilege escalation, and potential lateral movement within the application ecosystem. By altering attributes such as email addresses, passwords, or role assignments, an attacker can seize control of victim accounts, disrupt service availability for legitimate users, or establish persistent backdoors by modifying authentication credentials. This type of insecure direct object reference (IDOR) variant is particularly dangerous because it targets internal APIs that are often assumed to be protected from external access, yet lack robust per-request authorization logic when exposed through certain configurations or network paths.
The exploitation vector aligns with the MITRE ATT&CK technique T1078 Valid Accounts and potentially T1098 Account Manipulation, as attackers leverage valid credentials for a lower-privileged account to perform actions reserved for administrators or resource owners. The lack of proper access control checks means that once an attacker authenticates, they can enumerate user IDs via the endpoint structure and systematically overwrite data across multiple accounts if rate limiting or additional safeguards are not in place. This compromises the integrity and confidentiality aspects of the CIA triad, undermining trust in the platform's security posture.
Mitigation strategies must focus on implementing robust authorization checks at the API level. Developers should enforce strict ownership verification by ensuring that only the account owner or a designated system administrator can modify specific user fields. Implementing role-based access control (RBAC) with least privilege principles is essential to restrict write operations to authorized personnel. Additionally, integrating comprehensive logging and monitoring for anomalous patterns in internal API usage can aid in early detection of exploitation attempts. Regular security audits focusing on input validation and authorization logic are recommended to prevent similar flaws from persisting in future releases.