Executive brief
Cohere North is an enterprise AI platform used to automate workflows and manage business data. An access control vulnerability allows authenticated users to arbitrarily modify or delete their own user accounts—including changing email addresses and removing accounts entirely—without verification, potentially enabling account takeover or unauthorized data loss.
Technical details
The vulnerability exists in the /api/internal/v1/users/{{USER_ID}} endpoint of Cohere North AI v1.1.5, which suffers from improper authorization validation (CWE-284). An authenticated attacker can send crafted PUT or DELETE requests to modify sensitive profile fields (email, name, nickname) or delete the user account without triggering ownership verification or proper permission checks. The attack requires valid authentication credentials and network access to the API endpoint. Successful exploitation allows an attacker to take over accounts, manipulate user identity, or cause denial of service by deleting accounts. Patch availability has not been confirmed in the advisory.
Affected products
- Cohere North AI 1.1.5
Timeline
- 2025-11: disclosed: Publicly disclosed in November 2025
- 2026-08-26: advisory: CVE-2025-61162 published on NVD