CVE-2025-61162: IDOR — AWAITING NVD

CISO Take

Cohere North AI v1.1.5 exposes an internal user-management endpoint, /api/internal/v1/users/{USER_ID}, that fails to check whether the caller is authorized to modify the target account, letting an attacker overwrite arbitrary users' profile data with a single crafted request. This is a classic broken object-level authorization (IDOR) flaw — trivial to exploit with browser dev tools or Burp, no adversarial ML knowledge or exploit chain required. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so there are no active-exploitation signals to point to; the risk case rests on impact, not on observed attacker interest. North AI is Cohere's enterprise agentic workspace, so overwriting another user's email, role, or permissions could enable account takeover or privilege escalation into an environment that brokers access to internal agents and data sources. Confirm with Cohere whether a build beyond v1.1.5 fixes this, restrict /api/internal/* routes at the gateway to trusted service identities only, and audit user-record change logs for cross-account modifications until a vendor patch is verified.

Sources: NVD cohere.com ATLAS

What is the risk?

Unscored (no CVSS/EPSS published) but functionally high-severity: this is a broken access control / IDOR vulnerability with trivial exploitability (a single crafted HTTP request, no authentication bypass techniques or AI-specific tradecraft needed) and a potentially severe impact (arbitrary overwrite of user records, which can cascade into account takeover or privilege escalation). Mitigating factors are the current absence of a public exploit, Nuclei template, or KEV listing, and unknown deployment footprint (downstream dependents and package risk score are both unreported). Overall: low observed exploitation activity today, but high blast-radius-per-successful-attempt if North AI is used to gate access to sensitive agents, data connectors, or admin functions.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a valid low-privilege North AI user account/session.

AML.T0012

Exploitation

Attacker sends a crafted request to /api/internal/v1/users/{USER_ID} referencing a victim's user ID, exploiting the missing object-level authorization check.

AML.T0049

Privilege Escalation / Account Takeover

The overwritten user record (email or role field) is used to hijack the victim's account or grant the attacker elevated privileges within the workspace.

Impact

Attacker gains access to the victim's connected agents, data sources, and credentials managed within the North AI workspace.

Initial Access

Attacker obtains or already holds a valid low-privilege North AI user account/session.

AML.T0012

Exploitation

Attacker sends a crafted request to /api/internal/v1/users/{USER_ID} referencing a victim's user ID, exploiting the missing object-level authorization check.

AML.T0049

Privilege Escalation / Account Takeover

The overwritten user record (email or role field) is used to hijack the victim's account or grant the attacker elevated privileges within the workspace.

Impact

Attacker gains access to the victim's connected agents, data sources, and credentials managed within the North AI workspace.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Check with Cohere/North AI vendor support for a patched release beyond v1.1.5 and apply it. 2) Until patched, restrict network access to /api/internal/* endpoints so they are only reachable by legitimate backend services, not directly by end-user sessions (e.g., via reverse proxy/gateway ACL). 3) Add server-side authorization checks that verify the authenticated session's user ID matches the {USER_ID} path parameter (or that the caller holds an explicit admin role) before processing any write to /api/internal/v1/users/{USER_ID}. 4) Audit existing user-record change/audit logs for anomalous cross-account modifications (one user's session ID associated with changes to a different user's record). 5) Rotate credentials and force re-authentication for any accounts showing signs of tampering.

How is it classified?

Auth Bypass Privacy Violation API Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8.3 - Information security for AI systems

NIST AI RMF

GOVERN 1.5 - Processes for oversight, risk controls, and access management

Frequently Asked Questions

What is CVE-2025-61162?

Cohere North AI v1.1.5 exposes an internal user-management endpoint, /api/internal/v1/users/{USER_ID}, that fails to check whether the caller is authorized to modify the target account, letting an attacker overwrite arbitrary users' profile data with a single crafted request. This is a classic broken object-level authorization (IDOR) flaw — trivial to exploit with browser dev tools or Burp, no adversarial ML knowledge or exploit chain required. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template yet, so there are no active-exploitation signals to point to; the risk case rests on impact, not on observed attacker interest. North AI is Cohere's enterprise agentic workspace, so overwriting another user's email, role, or permissions could enable account takeover or privilege escalation into an environment that brokers access to internal agents and data sources. Confirm with Cohere whether a build beyond v1.1.5 fixes this, restrict /api/internal/* routes at the gateway to trusted service identities only, and audit user-record change logs for cross-account modifications until a vendor patch is verified.

Is CVE-2025-61162 actively exploited?

No confirmed active exploitation of CVE-2025-61162 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-61162?

1) Check with Cohere/North AI vendor support for a patched release beyond v1.1.5 and apply it. 2) Until patched, restrict network access to /api/internal/* endpoints so they are only reachable by legitimate backend services, not directly by end-user sessions (e.g., via reverse proxy/gateway ACL). 3) Add server-side authorization checks that verify the authenticated session's user ID matches the {USER_ID} path parameter (or that the caller holds an explicit admin role) before processing any write to /api/internal/v1/users/{USER_ID}. 4) Audit existing user-record change/audit logs for anomalous cross-account modifications (one user's session ID associated with changes to a different user's record). 5) Rotate credentials and force re-authentication for any accounts showing signs of tampering.

What systems are affected by CVE-2025-61162?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, identity and access management for AI platforms.

What is the CVSS score for CVE-2025-61162?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksidentity and access management for AI platforms

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.8.3

NIST AI RMF: GOVERN 1.5

What are the technical details?

Original Advisory

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint

Exploitation Scenario

An attacker with any valid low-privilege North AI account (or possibly no authentication at all, depending on session handling) enumerates or guesses another user's USER_ID — for example, sequential IDs or IDs harvested from shared workspace UI elements. They send a crafted PUT/PATCH request to /api/internal/v1/users/{victim_USER_ID} with a modified email address or elevated role field. Because the endpoint doesn't verify object-level ownership, the request succeeds, and the attacker either triggers a password reset to the new attacker-controlled email (full account takeover) or grants themselves admin privileges directly. From there, they gain access to the victim's connected agents, data sources, and any credentials or API keys the North AI workspace has stored on the victim's behalf.