PT-2025-18213 · Unknown · Khc-Invitation-Automation

Ekrishnachaitanya2004 · Published 2025-04-29 · Updated 2025-04-30 · CVE-2025-46552

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions KHC-INVITATION-AUTOMATION version 1.2

Description The issue concerns a GitHub automation script where user data, including email addresses and Discord usernames, were exposed in API responses without proper access controls. This allowed unauthorized users to access sensitive user information by directly calling specific endpoints.

Recommendations For KHC-INVITATION-AUTOMATION version 1.2, update to a later commit where the issue has been patched to resolve the problem. As a temporary workaround, consider restricting access to the API endpoints that expose user data until the update is applied.

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2025-46552

GHSA-7MPF-6GG2-2FJP

Affected Products

Khc-Invitation-Automation

References · 8

• https://osv.dev/vulnerability/CVE-2025-46552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46552 · Security Note
• https://github.com/Krypto-Hashers-Community/KHC-INVITATION-AUTOMATION/commit/bc908a4ef538b24d4543ae95a413be6afa308bf5 · Note
• https://github.com/Krypto-Hashers-Community/KHC-INVITATION-AUTOMATION/security/advisories/GHSA-7mpf-6gg2-2fjp · Note
• https://t.me/cvedetector/24061 · Telegram Post
• https://t.me/cvetracker/22665 · Telegram Post
• https://twitter.com/CVEnew/status/1917350780618604723 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1917415220978319637 · Twitter Post