CVE-2025-0743: Thesamur Embedai Information Disclosure Flaw

CVE-2025-0743 Overview

CVE-2025-0743 is an Improper Access Control vulnerability [CWE-284] affecting EmbedAI version 2.1 and below. The flaw resides in the /embedai/visits/show/<VISIT_ID> endpoint, which fails to enforce authorization checks between authenticated users. An attacker with valid credentials can enumerate VISIT_ID values to retrieve visitor records belonging to other tenants. The exposed data includes IP addresses, User-Agent strings, and geolocation information tied to individuals who visited pages served by other EmbedAI users.

Critical Impact
Authenticated attackers can harvest visitor telemetry (IP address, User-Agent, location) belonging to other EmbedAI users through predictable visit identifiers.

Affected Products

Thesamur EmbedAI 2.1
Thesamur EmbedAI versions prior to 2.1
All deployments exposing the /embedai/visits/show/ endpoint

Discovery Timeline

2025-01-30 - CVE-2025-0743 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0743

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) in EmbedAI's visit-tracking module. The /embedai/visits/show/<VISIT_ID> route accepts an identifier supplied in the URL path and returns the associated visit record. The application authenticates the requester but does not validate that the requester owns the resource referenced by VISIT_ID.

An attacker who registers a valid EmbedAI account can iterate through VISIT_ID values and read visit records belonging to any other tenant. Returned fields include the visitor's IP address, User-Agent header, and derived geolocation. The disclosure is limited to visitor metadata rather than account credentials or AI model data, which is reflected in the confidentiality-only impact profile.

Root Cause

The root cause is missing object-level authorization on the visit lookup handler. The application trusts the session identity for endpoint access but omits an ownership check tying the authenticated user to the requested VISIT_ID. This is a canonical Broken Object Level Authorization (BOLA) pattern classified under CWE-284: Improper Access Control.

Attack Vector

Exploitation requires network access to the EmbedAI application and a valid authenticated session. The attacker issues sequential HTTP GET requests to /embedai/visits/show/<VISIT_ID>, incrementing the identifier to enumerate visitor records. No user interaction, elevated privileges, or special tooling is required. Because identifiers are numeric and sequential, automated enumeration is trivial.

See the INCIBE CERT Advisory on EmbedAI vulnerabilities for coordinated disclosure details. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2025-0743

Indicators of Compromise

Sequential or high-volume GET requests to /embedai/visits/show/ from a single authenticated session
Requests to /embedai/visits/show/<VISIT_ID> where the VISIT_ID does not correlate with visits generated by the requester's tenant
Bursts of 200 OK responses on the visits endpoint returning JSON payloads containing IP and User-Agent fields

Detection Strategies

Deploy application-layer logging that records the authenticated user, requested VISIT_ID, and the resource owner for every call to the visits endpoint
Alert on session-to-owner mismatches where the authenticated user does not match the tenant that generated the visit record
Baseline normal request rates against the visits endpoint and flag deviations consistent with enumeration

Monitoring Recommendations

Forward web server and reverse proxy logs to a centralized analytics platform and search for enumeration patterns against /embedai/visits/show/
Monitor for unusual outbound traffic from EmbedAI hosts that could indicate bulk exfiltration of visit telemetry
Track authentication events tied to newly created accounts followed by rapid access to enumeration-prone endpoints

How to Mitigate CVE-2025-0743

Immediate Actions Required

Upgrade EmbedAI to a version above 2.1 once the vendor publishes a fixed release
Restrict access to the EmbedAI administrative interface to trusted networks and known accounts
Rotate or invalidate active session tokens after applying the fix to evict any pre-existing enumeration sessions

Patch Information

At the time of the last NVD update on 2026-06-17, no vendor advisory URL or fixed-version identifier is referenced in the CVE record. Consult the INCIBE CERT Advisory and the vendor's release channel for a patched EmbedAI build addressing CVE-2025-0743.

Workarounds

Place EmbedAI behind a reverse proxy or web application firewall that rate-limits requests to /embedai/visits/show/ per authenticated session
Restrict user registration to trusted individuals to reduce the pool of accounts that can reach the vulnerable endpoint
Add an upstream authorization filter that validates the requesting user owns the referenced visit record before proxying to the backend

bash

# Example NGINX rate limit for the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=embedai_visits:10m rate=10r/m;

location ~ ^/embedai/visits/show/ {
    limit_req zone=embedai_visits burst=5 nodelay;
    proxy_pass http://embedai_backend;
}