CVE-2025-63664
Unauthorized Access via API in GT Edge AI Platform Messages
Publication date: 2025-12-22
Last updated on: 2025-12-22
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gt_edge | ai_platform | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-63664 is an incorrect access control vulnerability in the GT Edge AI Platform's API endpoint `/api/v1/conversations/*/messages`. This flaw allows unauthorized remote attackers who have a valid user ID to access and read other users' message histories with AI agents, leading to information disclosure and escalation of privileges. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing unauthorized attackers to access your private message history with AI agents, resulting in the disclosure of sensitive information. Attackers can escalate their privileges by exploiting this flaw, potentially compromising user privacy and data confidentiality. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring or testing access to the API endpoint `/api/v1/conversations/*/messages` for unauthorized access attempts. Specifically, you can attempt to access message histories of other users using valid user IDs to verify if access control is improperly enforced. Network traffic analysis tools like Wireshark or tcpdump can be used to capture API requests to this endpoint. Additionally, using curl or similar HTTP clients to send requests to `/api/v1/conversations/{other_user_id}/messages` and checking if unauthorized data is returned can help detect the issue. Example command: `curl -X GET https://<target>/api/v1/conversations/{other_user_id}/messages -H 'Authorization: Bearer <valid_token>'` and observe if messages from other users are accessible. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the GT Edge AI Platform software to version 2.0.12 or later, where this incorrect access control vulnerability has been fixed. Until the upgrade can be applied, restrict access to the vulnerable API endpoint `/api/v1/conversations/*/messages` by implementing network-level controls such as firewall rules or API gateway policies to limit access only to authorized users. Additionally, monitor logs for suspicious access patterns to this endpoint and revoke any suspicious user tokens. [1]