Aihelms
Monthly
AIHelms 0.1.25 and earlier fails to enforce efficiency:read and efficiency:write authorization in its analytics API, allowing any authenticated low-privileged user to read organization-wide AI spend data and to modify suggestion statuses or generate reports. The exposed routes include /cost/detail, /top-users and /budget in apps/api/v1/efficiency.py, and exploitation requires only a valid low-privilege account - no elevated permissions and no user interaction. Independent assessment rates this a genuine but moderate-priority issue (assessed CVSS 3.1 5.3 with PR:L, C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis.
AIHelms 0.1.25 and earlier fails to enforce efficiency:read and efficiency:write authorization in its analytics API, allowing any authenticated low-privileged user to read organization-wide AI spend data and to modify suggestion statuses or generate reports. The exposed routes include /cost/detail, /top-users and /budget in apps/api/v1/efficiency.py, and exploitation requires only a valid low-privilege account - no elevated permissions and no user interaction. Independent assessment rates this a genuine but moderate-priority issue (assessed CVSS 3.1 5.3 with PR:L, C:L/I:L/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis.