Improper access control arbitrary allows account creation
June 9, 2025
Products Impacted
This vulnerability is present in all versions of BackendAI. We tested on version 25.3.3 (commit f7f8fe33ea0230090f1d0e5a936ef8edd8cf9959).
CVSS Score: 9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE Categorization
CWE-284: Improper Access Control
Details
To sign up, an attacker can use the API endpoint /func/auth/signup. Then, using the login credentials, the attacker can access the account.
To reproduce this, we made a Python script to reach the endpoint and signup. Using those login credentials on the endpoint /server/login we get a valid session. When running the exploit, we get a valid AIOHTTP_SESSION cookie, or we can reuse the credentials to log in.
We can then try to login with those credentials and notice that we successfully logged in
Related SAI Security Advisory
September 11, 2026
_READ_ONLY_COMMANDS_POSIX expansion adds 31 commands with no path checking, granting unconditional access to the full host filesystem
Mistral Vibe automatically approves a large set of commands that are not subject to the expected workspace path restrictions, allowing files anywhere on the host to be accessed without user approval.
September 11, 2026
Environment variable prefixes stripped from permission check enable RCE via env injection
Mistral Vibe does not consider environment variable assignments when checking whether a command can run without approval, allowing environment controlled behavior in allowlisted programs such as Git to be abused for arbitrary code execution.