# CVE-2025-61162: Cohere North AI access control bypass in user management API

Source: https://junglewise.ai/threats/cve-2025-61162-cohere-north-ai-access-control-bypass-in-user-management-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-61162 · Severity: high · CVSS 7.5 · Published 2026-08-26

Cohere North is an enterprise AI platform used to automate workflows and manage business data. An access control vulnerability allows authenticated users to arbitrarily modify or delete their own user accounts—including changing email addresses and removing accounts entirely—without verification, potentially enabling account takeover or unauthorized data loss.

Technologies: [Cohere North AI](https://junglewise.ai/threats/technologies/north-ai). Vendors: [Cohere](https://junglewise.ai/threats/vendors/cohere).

## Quick answers

**Is CVE-2025-61162 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61162 being exploited in the wild.

**How severe is CVE-2025-61162?** High severity, with a CVSS score of 7.5, published 26 August 2026.

**Which products and versions are affected?** Cohere North AI 1.1.5.

**Is there a fix for CVE-2025-61162?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-61162 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2025-61162?** Check whether you run Cohere North AI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the /api/internal/v1/users/{{USER_ID}} endpoint of Cohere North AI v1.1.5, which suffers from improper authorization validation (CWE-284). An authenticated attacker can send crafted PUT or DELETE requests to modify sensitive profile fields (email, name, nickname) or delete the user account without triggering ownership verification or proper permission checks. The attack requires valid authentication credentials and network access to the API endpoint. Successful exploitation allows an attacker to take over accounts, manipulate user identity, or cause denial of service by deleting accounts. Patch availability has not been confirmed in the advisory.

## Affected products

- Cohere North AI 1.1.5

## Timeline

- 2025-11: disclosed: Publicly disclosed in November 2025
- 2026-08-26: advisory: CVE-2025-61162 published on NVD

## References

- [https://cohere.com/north](https://cohere.com/north)
- [https://github.com/bdadoa/Cohere---North-AI-1.1.5---Vulnerabilities/blob/main/CVE-2025-61162.md](https://github.com/bdadoa/Cohere---North-AI-1.1.5---Vulnerabilities/blob/main/CVE-2025-61162.md)

## Related threats

- [Cohere North AI information disclosure via WebSocket endpoint](https://junglewise.ai/threats/cve-2025-61164-cohere-north-ai-information-disclosure-via-websocket-endpoint)
- [Cohere North AI improper cross-domain policy in WebSocket](https://junglewise.ai/threats/cve-2025-61163-cohere-north-ai-improper-cross-domain-policy-in-websocket)