Restaurant Brands International Assistant
by RBI
CVEs (10)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-62645 | Cri | 0.64 | 9.9 | 0.01 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation. | ||
| CVE-2025-62650 | Hig | 0.54 | 8.3 | 0.00 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen. | ||
| CVE-2025-62651 | Med | 0.42 | 6.5 | 0.00 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface. | ||
| CVE-2025-62648 | Med | 0.42 | 6.4 | 0.00 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume. | ||
| CVE-2025-62649 | Med | 0.38 | 5.8 | 0.00 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders. | ||
| CVE-2025-62642 | Med | 0.38 | 5.8 | 0.00 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account. | ||
| CVE-2025-62647 | Med | 0.33 | 5.0 | 0.00 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path. | ||
| CVE-2025-62646 | Med | 0.33 | 5.0 | 0.01 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers. | ||
| CVE-2025-62644 | Med | 0.33 | 5.0 | 0.00 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users. | ||
| CVE-2025-62643 | Low | 0.22 | 3.4 | 0.00 | Oct 17, 2025 | The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages. |
- risk 0.64cvss 9.9epss 0.01
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.
- risk 0.54cvss 8.3epss 0.00
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.
- risk 0.42cvss 6.5epss 0.00
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for the bathroom rating interface.
- risk 0.42cvss 6.4epss 0.00
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume.
- risk 0.38cvss 5.8epss 0.00
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders.
- risk 0.38cvss 5.8epss 0.00
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.
- risk 0.33cvss 5.0epss 0.00
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning a JWT that can be used to call an API to return a signed AWS upload URL, for any store's path.
- risk 0.33cvss 5.0epss 0.01
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.
- risk 0.33cvss 5.0epss 0.00
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users.
- risk 0.22cvss 3.4epss 0.00
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages.