CVE-2025-61162: Cohere North AI vulnerability
Published Aug 26, 2026
·Updated
Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{USERID}} endpoint
Affected Software
1 affected component
Cohere North AI=1.1.5
Event History
Aug 26, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·07:16 PM
Description
Frequently Asked Questions
1
What does an attacker need to exploit this issue?
The attacker needs to send a crafted request to the internal user endpoint at /api/internal/v1/users/{{USER_ID}}. The provided information does not specify whether authentication, network access, or a particular user role is required.
2
What is the likely impact if exploitation succeeds?
An attacker can arbitrarily overwrite user information for the user identifier targeted in the request. The available data does not identify which user fields can be changed or whether privileged accounts can be targeted.