What is the CVSS score of CVE-2025-61162?

CVE-2025-61162 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Cohere North AI are affected by CVE-2025-61162?

Cohere North AI v1.1.5 contains a critical unauthenticated API vulnerability enabling remote attackers to arbitrarily modify user account data without credentials, directly compromising user identity…

How to fix or mitigate CVE-2025-61162?

Within 24 hours, conduct an inventory of all systems running Cohere North AI v1.1.5 and immediately restrict external network access to the /api/internal/v1/users/ API endpoint using firewall rules; review access logs for suspicious HTTP requests to this endpoint and document any unauthorized modifications. Within 7 days, deploy Web Application Firewall (WAF) rules to block malicious payloads targeting user-management endpoints, implement comprehensive API logging and alerting for all requests to /api/internal/v1/users/, and contact the vendor to obtain a patch timeline and ETA. Within 30 days, evaluate available upgrade paths or migration to alternative products if patches remain unavailable; prepare a testing environment for rapid patch deployment; and validate all user account records for unauthorized modifications made during the exposure window.

Cohere North AI CVE-2025-61162

EUVD-2025-210787 HIGH

Improper Access Control (CWE-284)

2026-08-26 mitre

GHSA-6pmx-p277-96g6

Authentication Bypass Red Hat N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-reachable endpoint with no auth gate; integrity-only impact as no data exfiltration or service disruption is described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 22:42 vuln.today

CVSS changed

Aug 27, 2026 - 20:37 NVD

7.5 (HIGH)

CVE Published

Aug 26, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Aug 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint

AnalysisAI

Unauthenticated integrity compromise in Cohere North AI v1.1.5 exposes an internal user-management API endpoint with no effective access control, allowing any remote attacker to overwrite arbitrary user account data via crafted HTTP requests to /api/internal/v1/users/{USER_ID}. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag both confirm exploitation requires no credentials and no user interaction. A researcher-published PoC exists on GitHub, though EPSS remains low (0.14%, 4th percentile) and no CISA KEV listing has been issued.

Technical ContextAI

The vulnerability resides in the internal REST API of Cohere North AI v1.1.5, a collaborative AI platform. The affected endpoint /api/internal/v1/users/{USER_ID} is intended for privileged internal operations but fails to enforce any authentication or authorization gate, falling squarely under CWE-284 (Improper Access Control). The 'internal' path prefix implies the endpoint was designed for server-side or privileged use only, but the access control mechanism is absent or bypassable, enabling IDOR-adjacent (Insecure Direct Object Reference) manipulation of user records by specifying arbitrary USER_ID values. NVD has not assigned a formal CPE string (cpe:2.3:a:n/a:n/a), indicating the product scope has not been independently verified in the National Vulnerability Database.

RemediationAI

No vendor-released patch or security advisory has been identified at time of analysis - the only public references are the NVD entry and the researcher's GitHub disclosure; the cohere.com/north URL is a product marketing page, not a security advisory. Organizations running Cohere North AI v1.1.5 should immediately restrict network-level access to the /api/internal/v1/users/ endpoint path at the API gateway, reverse proxy, or firewall layer, preventing external or untrusted clients from reaching it directly (note: this may break legitimate internal workflows depending on how the endpoint is used). Additionally, apply authentication enforcement at the API layer (e.g., require a valid session token or service credential for all /api/internal/ routes) as a compensating control until an official patch is released. Contact Cohere directly for vendor guidance and monitor https://cohere.com/north and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2025-61162 for patch availability.