CVE-2025-46552 Overview
CVE-2025-46552 is an information disclosure vulnerability in KHC-INVITATION-AUTOMATION, a GitHub automation script that invites followers of a bot account to join an organization. Certain commits on version 1.2 exposed user data, including email addresses and Discord usernames, through API responses lacking proper access controls. Unauthorized users could retrieve sensitive user information by directly calling specific endpoints. The issue was resolved in a later commit on version 1.2. The weakness is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated network attackers can retrieve user email addresses and Discord usernames by directly calling exposed API endpoints, enabling downstream phishing and account takeover activity.
Affected Products
- KHC-INVITATION-AUTOMATION (Krypto-Hashers-Community)
- Version 1.2 (specific commits prior to the fix)
- GitHub-hosted deployments running the vulnerable commits
Discovery Timeline
- 2025-04-29 - CVE-2025-46552 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46552
Vulnerability Analysis
The vulnerability resides in API endpoints exposed by the KHC-INVITATION-AUTOMATION script. The endpoints returned user records containing email addresses and Discord usernames without enforcing authentication or authorization checks. Any client capable of reaching the service could issue direct requests and retrieve records intended for privileged users only.
The exposure exists in commits on version 1.2 and was corrected in a later commit on the same branch. Because the leaked fields include email addresses and third-party account identifiers, harvested data supports targeted phishing, credential stuffing against Discord accounts, and social engineering against organization members.
Root Cause
The root cause is missing access control on API endpoints that serve user data. The application returns sensitive fields in API responses without verifying the caller's identity or permissions. This is a classic broken access control pattern captured by [CWE-200].
Attack Vector
Exploitation requires only network access to the vulnerable instance. An attacker sends unauthenticated HTTP requests directly to the affected endpoints and parses the JSON responses to extract user records. No user interaction, credentials, or elevated privileges are required. Because responses are returned in machine-readable form, enumeration can be fully scripted. The Exploit Prediction Scoring System reports a low near-term exploitation probability, and no public proof-of-concept has been published at the time of writing.
See the GitHub Security Advisory GHSA-7mpf-6gg2-2fjp for details on the affected endpoints.
Detection Methods for CVE-2025-46552
Indicators of Compromise
- Repeated unauthenticated requests to user-data API endpoints from a single IP or narrow range
- Anomalously large or fast enumeration of user records in application logs
- Outbound API responses containing bulk email addresses or Discord usernames to unexpected clients
Detection Strategies
- Review access logs for requests to user-listing endpoints that lack a valid session or authorization header
- Compare deployed commit hashes against the fixed commit bc908a4 to confirm exposure
- Correlate high-volume GET requests against user endpoints with subsequent phishing reports targeting organization members
Monitoring Recommendations
- Instrument the application with request-level logging that records source IP, endpoint, authentication state, and response size
- Forward web and API logs to a centralized analytics platform and alert on unauthenticated access to user data endpoints
- Monitor for spikes in outbound response payload sizes on endpoints known to return user records
How to Mitigate CVE-2025-46552
Immediate Actions Required
- Update the deployed KHC-INVITATION-AUTOMATION instance to the patched commit on version 1.2
- Rotate any API tokens or bot credentials associated with the vulnerable deployment
- Notify affected users whose email addresses or Discord usernames may have been exposed
Patch Information
The maintainers fixed the issue in a later commit on version 1.2. Review the patch commit bc908a4ef538b24d4543ae95a413be6afa308bf5 and redeploy from the fixed revision. Verify the running commit hash after deployment.
Workarounds
- Restrict network access to the automation service using firewall rules or a reverse proxy allowlist until the patch is applied
- Place the service behind an authenticating proxy that rejects unauthenticated requests to user-data endpoints
- Temporarily disable the affected API endpoints if organizational workflows can tolerate the outage
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
