What is the CVSS score of CVE-2025-61163?

CVE-2025-61163 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cohere North are affected by CVE-2025-61163?

Cohere North AI v1.1.5 contains a CORS misconfiguration allowing unauthorized browser-based disclosure of sensitive API responses, affecting all organizations running this version.

How to fix or mitigate CVE-2025-61163?

Within 24 hours, inventory all instances of Cohere North AI v1.1.5 in production and identify systems processing sensitive data through the platform. Within 7 days, implement compensating controls such as Web Application Firewall rules to enforce strict Origin header validation, restrict API access to known internal origins, or disable CORS entirely if cross-origin requests are not operationally required. Within 30 days, monitor the vendor advisory for patch availability and plan a phased upgrade strategy; if no patch emerges within 90 days, evaluate replacement products with proper cross-origin request validation.

Cohere North CVE-2025-61163

EUVD-2025-210786 CRITICAL

Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942)

2026-08-26 mitre

GHSA-ppjh-2wmr-qh8x

Information Disclosure Cors Misconfiguration N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

CORS flaw needs a logged-in victim to visit attacker content, so UI:R; primarily discloses data (C:H) with limited state-change (I:L) and no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 22:32 vuln.today

CVSS changed

Aug 27, 2026 - 20:37 NVD

9.8 (CRITICAL)

CVE Published

Aug 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 26, 2026 - 00:00 cve.org

CRITICAL 9.8

DescriptionCVE.org

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.

AnalysisAI

Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validating the Origin header, letting any untrusted website read authenticated API responses in a victim's browser. Affects the North enterprise AI platform; tagged as CORS misconfiguration / information disclosure. No public exploit or active exploitation is identified, and EPSS is low (0.14%, 4th percentile), though the NVD-published CVSS of 9.8 likely overstates real-world impact.

Technical ContextAI

The root cause is CWE-942 (Permissive Cross-Domain Policy with Untrusted Domains). Cohere North is a self/enterprise-hosted generative-AI workspace exposing HTTP/JSON APIs consumed by a browser front end. Browsers enforce the Same-Origin Policy, but servers can relax it via CORS response headers (Access-Control-Allow-Origin / Access-Control-Allow-Credentials). Here the server reflects or wildcards the requesting Origin instead of matching it against an allowlist, so a page on any attacker-controlled domain can issue credentialed cross-origin XHR/fetch calls and read the responses. CPE data is uninformative (cpe:2.3:a:n/a:n/a:*), so exact affected components beyond 'North AI 1.1.5' cannot be enumerated from the feed.

RemediationAI

No vendor-released patch version is identified at time of analysis, so contact Cohere for a fixed North build and monitor https://cohere.com/north for updates. As concrete compensating controls: configure the server (or a fronting reverse proxy) to reject or not reflect unrecognized Origin headers and replace any wildcard/reflected Access-Control-Allow-Origin with a strict allowlist of trusted first-party origins - side effect: legitimate integrations on other domains will break until explicitly allowlisted. Avoid pairing Access-Control-Allow-Credentials: true with a permissive origin. Where feasible, place North behind an authenticating gateway or restrict access to a trusted network/VPN so browsers of authenticated users cannot be lured into cross-origin requests from arbitrary internet sites; trade-off is reduced accessibility for remote/SaaS-style users. Refer to the GitHub advisory for the specific misconfigured endpoint details.