Description
Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Lablup | BackendAI | < 25.15.6 | 25.15.6 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | backend-ai | < 25.15.6 | 25.15.6 | GHSA-ww28-4m4v-cq4j |
| PyPI | backend-ai | >= 25.16.0rc1, < 25.19.0rc1 | 25.19.0rc1 | GHSA-ww28-4m4v-cq4j |
| PyPI | backend-ai | < 25.15.6 · >= 25.16.0rc1, < 25.19.0rc1 | 25.15.6, 25.19.0rc1 | PYSEC-2026-290 |