CVE-2025-61162: Cohere North AI Auth Bypass Vulnerability

CVE-2025-61162 Overview

CVE-2025-61162 is an incorrect access control vulnerability in Cohere North AI version 1.1.5. The flaw resides in the /api/internal/v1/users/{USER_ID} endpoint. Attackers can send a crafted request to arbitrarily overwrite user information belonging to other accounts. The endpoint fails to verify that the requester is authorized to modify the targeted user record, resulting in broken access control [CWE-284] and an insecure direct object reference [CWE-639]. Cohere North is an enterprise generative AI workspace platform used for internal knowledge retrieval and agentic workflows, making unauthorized modification of user records a direct threat to workspace integrity.

Critical Impact
Unauthenticated or low-privileged attackers can overwrite arbitrary user profile data by supplying any USER_ID in the request path, enabling account takeover paths and data tampering across the tenant.

Affected Products

Cohere North AI v1.1.5
Cohere North AI internal user management API (/api/internal/v1/users/{USER_ID})
Deployments of Cohere North running the affected release

Discovery Timeline

2026-08-26 - CVE-2025-61162 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2025-61162

Vulnerability Analysis

The vulnerability is a server-side access control failure. The internal user management endpoint accepts a USER_ID path parameter and processes an update payload without validating whether the authenticated session owns or has administrative rights over the target account. As a result, any caller who can reach the internal API can rewrite fields on any user record.

The endpoint is scoped under /api/internal/v1/, indicating it was intended for privileged internal use. Exposure without a corresponding authorization check turns a routine profile update route into a tenant-wide write primitive.

Root Cause

The root cause is a missing authorization check on user update operations. The handler binds the USER_ID from the URL directly to the record targeted for modification. It does not compare the target identifier against the caller's identity or role. This is a classic Insecure Direct Object Reference combined with missing function-level access control.

Attack Vector

An attacker with API access iterates or guesses USER_ID values and issues an update request to /api/internal/v1/users/{USER_ID}. The server accepts the modified fields and persists them to the target user. Depending on which fields are writable, attackers may alter email addresses, display names, roles, or other attributes tied to authentication and authorization. Full technical detail is available in the GitHub CVE-2025-61162 Vulnerability Report and the Cohere North product overview.

No public exploit code has been catalogued in NVD, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-61162

Indicators of Compromise

HTTP PUT, PATCH, or POST requests to /api/internal/v1/users/{USER_ID} where the path USER_ID does not match the authenticated session's user identifier.
Rapid, sequential requests iterating across multiple USER_ID values from a single source address or session token.
Unexpected modifications to user profile fields (email, role, display name) not preceded by an administrative workflow event.

Detection Strategies

Correlate authenticated session identity against the USER_ID path parameter in application access logs and alert on mismatches.
Deploy Web Application Firewall (WAF) rules that flag write methods against /api/internal/v1/users/ from non-administrative principals.
Baseline normal user-update volume per account and alert on deviations that suggest enumeration.

Monitoring Recommendations

Enable full request and response logging on the internal user management API, capturing caller identity, path parameters, and modified fields.
Forward application logs and identity provider events into a central analytics platform for cross-correlation with authentication anomalies.
Monitor audit trails for privilege changes and email-address rewrites that could precede account takeover.

How to Mitigate CVE-2025-61162

Immediate Actions Required

Restrict network exposure of the /api/internal/v1/ route to trusted administrative networks or service meshes only.
Revoke and reissue API tokens that had access to the internal user management endpoint during the exposure window.
Audit the users table for unauthorized modifications made against Cohere North v1.1.5 deployments.
Contact Cohere for guidance on a fixed release before deploying v1.1.5 in production.

Patch Information

No vendor patch reference is currently listed in the NVD entry for CVE-2025-61162. Operators should track the Cohere North product page and the GitHub vulnerability report for remediation updates and upgrade to a fixed version once released.

Workarounds

Place the application behind a reverse proxy that blocks external requests to any path beginning with /api/internal/.
Enforce server-side authorization by adding a middleware check that compares the authenticated principal against the requested USER_ID and rejects mismatches for non-administrators.
Disable or gate self-service profile update flows until an authorization fix is in place.

bash

# Example NGINX rule to block external access to the internal user API
location ~ ^/api/internal/ {
    allow 10.0.0.0/8;      # internal admin network
    deny all;
    proxy_pass http://cohere_north_backend;
}