What is the CVSS score of CVE-2025-62645?

CVE-2025-62645 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Restaurant Brands International Assistant are affected by CVE-2025-62645?

The Restaurant Brands International (RBI) assistant platform, in versions through 2025-09-06, can be fully taken over by an authenticated low-privilege user who mints a platform-wide administrative…

Is there a public PoC exploit available for CVE-2025-62645?

Yes, a public proof-of-concept exploit is available for CVE-2025-62645. Prioritise patching immediately. EPSS: 0.7%.

How to fix or mitigate CVE-2025-62645?

Within 24 hours, inventory all RBI assistant platform deployments and confirm whether any are at or below version 2025-09-06; restrict network access to the platform to trusted users and networks, rotate all platform tokens and secrets, and if operationally feasible disable or block the createToken GraphQL mutation while preserving evidence and monitoring for administrative token creation. Within 7 days, implement compensating controls such as GraphQL allowlisting or a WAF rule that rejects createToken calls, enforce least privilege and strong authentication for all accounts, review logs for unexpected admin token issuance or privilege escalation, and engage the vendor for an emergency patch timeline. Within 30 days, deploy the vendor-released patch as soon as it becomes available-no vendor-released patch identified at time of analysis-validate remediation with a focused penetration test, and update incident response and access-review procedures to detect similar privilege-assignment flaws.

Restaurant Brands International Assistant CVE-2025-62645

CRITICAL

Incorrect Privilege Assignment (CWE-266)

2025-10-17 cve@mitre.org

Information Disclosure Restaurant Brands International Assistant

9.9

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network GraphQL endpoint and no interaction give AV:N/AC:L/UI:N; a low-privilege account is required so PR:L; escalation to platform-wide admin beyond the user's authorized scope justifies S:C with full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 22:41 vuln.today

CVE Published

Oct 17, 2025 - 21:15 cve.org

CRITICAL 9.9

DescriptionCVE.org

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.

AnalysisAI

The Restaurant Brands International (RBI) assistant platform (versions through 2025-09-06) improperly grants administrative privileges through its createToken GraphQL mutation, allowing any authenticated user with a low-privilege account to mint a platform-wide administrative token. Because the token grants full control over the platform, an attacker with even a basic foothold can escalate to complete compromise (CWE-266, Incorrect Privilege Assignment); the assessed CVSS 3.1 base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), with the only prerequisite being a valid authenticated session and no user interaction or special configuration. Publicly available exploit code exists and the flaw is documented in public reporting, though no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.

Technical ContextAI

The issue is a broken privilege-assignment flaw (CWE-266) in a GraphQL API exposed by the RBI assistant platform that powers drive-thru and customer-facing ordering flows for brands including Burger King, Popeyes and Tim Hortons. GraphQL mutations are the write-side counterpart to queries; the createToken mutation is intended to issue a scoped session or service token, but the implementation fails to bind the issued token to the caller's own privilege level or scope, instead returning a token with administrative privileges for the entire platform. Because authorization is enforced downstream on the token rather than re-validated against the authenticated user, the minted admin token bypasses role boundaries entirely. The CVSS vector's Scope:Changed (S:C) reflects that the vulnerable component's authorization decision impacts resources beyond its own security authority, allowing lateral control across the broader multi-tenant platform. CPE data (cpe:2.3:a:rbi:restaurant_brands_international_assistant:*:*:*:*:*:*:*:*) indicates all versions tracked up to and including the reporting date of 2025-09-06 are affected, with no vendor-fixed version identified.

RemediationAI

No vendor-released patch was identified at time of analysis, so remediation must begin with compensating controls while an official fix is pursued with RBI/vendor engineering. Primary action: treat createToken as a privileged operation - require re-authentication and server-side authorization checks that bind the issued token's scope to the caller's actual role, and reject any request whose requested token privileges exceed the authenticated principal's own privileges; this is a code change on the GraphQL resolver rather than a configuration toggle. Interim mitigations, with trade-offs: remove or disable the createToken mutation from externally reachable GraphQL endpoints (breaks legitimate token issuance flows for all clients until re-implemented), enforce strict role-based access control and least privilege on the service accounts that can call it so that only trusted backend callers reach the mutation (may not be possible for public-facing drive-thru clients), rotate and shorten the lifetime of all platform tokens and invalidate any token issued with administrative scope (forced re-authentication causes session disruption), enable verbose authorization logging and alerting on createToken calls that return elevated scopes (log volume and tuning overhead), and restrict network reachability of the GraphQL API to trusted ranges/partners via WAF or mTLS (may block legitimate customer traffic). Monitor the disclosure sources listed in the references for an official vendor advisory and patched version, and apply it as soon as it becomes available.