RBI Assistant Platform CVE-2025-62644

No vendor-released patch was identified in the available data at time of analysis, and no RBI security advisory appears among the supplied references, so remediation should begin with disclosure to RBI and a request for an official fixed build rather than assuming an upgrade path exists. In the interim, the highest-value compensating control is to gate the Global Store Directory behind an explicit role and brand-scope authorization check on the server side so a session can only resolve records it legitimately owns; the trade-off is that franchisees and multi-brand operators who currently rely on cross-store lookups will lose that convenience and may need a request/approval workflow instead. Where the directory cannot be changed immediately, apply field-level redaction of direct identifiers (names, phone numbers, addresses, emails) in the API response and log or alert on high-volume enumeration patterns from a single account, accepting that this degrades legitimate reporting and may break downstream integrations that expect full records. Additional short-term measures with low side effects include disabling or allow-listing the directory endpoint to known corporate IP ranges, enforcing MFA and prompt re-verification for accounts with directory access, and auditing existing accounts for stale franchisee or partner credentials - each of which reduces the population able to reach the feature but does not fix the underlying authorization flaw. Monitor the researcher write-up and Malwarebytes coverage for an updated vendor statement and apply the official fix as soon as RBI publishes one.