The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during…

published 2025-09-29 13 mo ago modified 2026-09-29 40 d ago also EUVD-2025-31575

cvss: 3.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

The openml/openml.org web application version v2.0.20241110 uses incremental user IDs and insufficient email ownership verification during email update workflows. An authenticated attacker controlling a user account with a lower user ID can update their email address to that of another user with a higher user ID without proper verification. This results in the victim's email being reassigned to the attacker's account, causing the victim to be locked out immediately and unable to log in. The vulnerability leads to denial of service via account lockout but does not grant the attacker direct access to the victim's private data.

Patch / fix

fixed in 1

openml openml_frontend 2.0.20251111

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 13 mo ago (2025-09-29)

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/openml/openml.org/security/advisories/GHSA-87c5-mc8v-xf7r referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	3.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CNA	3.1	3.5	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N

Classification

Weakness

CWE-284 Improper Access Control
CWE-639 Authorization Bypass Through User-Controlled Key

References

github.com /openml/openml.org/security/advisories/GHSA-87c5-mc8v-xf7r
exploit, vendor-advisory
github.com /openml
product
github.com /openml/openml.org
product

Sources

CVE List CVE-2025-55795
NVD CVE-2025-55795

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary