VYPR
Get started
← All advisories
Critical severity9.8NVD Advisory· Published Jun 9, 2025· Updated Apr 15, 2026

CVE-2025-49652

CVE-2025-49652

Description

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
backend.aiPyPI
< 25.15.625.15.6
backend.aiPyPI
>= 25.16.0rc1, < 25.19.0rc125.19.0rc1

Patches

3
37fc8f70f9ba

feat(BA-3446): Change default signup status to inactive (#7520) (#7544)

https://github.com/lablup/backend.aioctodogDec 19, 2025via ghsa
commit
2 files changed · +2 −1
  • changes/7520.feature.md+1 −0 added
    @@ -0,0 +1 @@
+Change default signup status to inactive preventing newly registered accounts access system resources until an administrator explicitly activates them
  • src/ai/backend/manager/services/auth/service.py+1 −1 modified
    @@ -226,7 +226,7 @@ async def signup(self, action: SignupAction) -> SignupActionResult:
             "need_password_change": False,
             "full_name": action.full_name if action.full_name is not None else "",
             "description": action.description if action.description is not None else "",
-            "status": UserStatus.ACTIVE,
+            "status": UserStatus.INACTIVE,
             "status_info": "user-signup",
             "role": UserRole.USER,
             "integration_id": None,
d7704f506e31

feat(BA-3446): Change default signup status to inactive (#7520) (#7545)

https://github.com/lablup/backend.aioctodogDec 19, 2025via ghsa
commit
2 files changed · +2 −1
  • changes/7520.feature.md+1 −0 added
    @@ -0,0 +1 @@
+Change default signup status to inactive preventing newly registered accounts access system resources until an administrator explicitly activates them
  • src/ai/backend/manager/services/auth/service.py+1 −1 modified
    @@ -228,7 +228,7 @@ async def signup(self, action: SignupAction) -> SignupActionResult:
             "need_password_change": False,
             "full_name": action.full_name if action.full_name is not None else "",
             "description": action.description if action.description is not None else "",
-            "status": UserStatus.ACTIVE,
+            "status": UserStatus.INACTIVE,
             "status_info": "user-signup",
             "role": UserRole.USER,
             "integration_id": None,
b6d3ddd9e285

feat(BA-3446): Change default signup status to inactive (#7520)

https://github.com/lablup/backend.aiBokyum Kim | 김보겸Dec 19, 2025via ghsa
commit
2 files changed · +2 −1
  • changes/7520.feature.md+1 −0 added
    @@ -0,0 +1 @@
+Change default signup status to inactive preventing newly registered accounts access system resources until an administrator explicitly activates them
  • src/ai/backend/manager/services/auth/service.py+1 −1 modified
    @@ -221,7 +221,7 @@ async def signup(self, action: SignupAction) -> SignupActionResult:
             "need_password_change": False,
             "full_name": action.full_name if action.full_name is not None else "",
             "description": action.description if action.description is not None else "",
-            "status": UserStatus.ACTIVE,
+            "status": UserStatus.INACTIVE,
             "status_info": "user-signup",
             "role": UserRole.USER,
             "integration_id": None,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.