Summary
Deloitte AI Assist for Customer contained multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could read or write data to the RAG corpus or make limited modifications to configurations.
Vulnerabilities 3
-
Medium 5.3
Deloitte AI Assist for Customer information disclosure
Deloitte AI Assist for Customer disclosed some configuration information through public-facing API endpoints that accepted unauthenticated requests. This information could reduce an attacker’s reconnaissance effort. On 2026-03-25, AI Assist for Customer restr…
-
Medium 5.3
Deloitte AI Assist for Customer unauthenticated configuration write
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public-facing API endpoints that allowed a remote attacker to make limited additions to the configuration. These additions were not used by the system. On 2026-03-25, AI Assist for…
-
Medium 4.8
Deloitte AI Assist for Customer unauthenticated RAG corpus read and write
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer r…
Revision history
-
#1.0.1
Fixed CVE self-reference URL errors
-
#1.0.0
Initial publication