EmbedAI Improper Access Control Vulnerability Allowing Information Disclosure About User Visits

A vulnerability allowing improper access control has been identified in EmbedAI versions prior to 2.1. This issue enables authenticated attackers to access the endpoint '/embedai/visits/show/<VISIT_ID>' and retrieve information about visits made by other users. The data obtained includes the IP address, user agent, and location of the users who visited the web page.

Impact

Exploitation of this vulnerability could lead to unauthorized disclosure of user visit information, including IP addresses, user agents, and geographical locations.

Remediation

Users can upgrade to EmbedAI version 2.1 to address this vulnerability.