Incorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access other users' message histo...
Date: 2025-12
Affected: gtedge/gt_edge_ai
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-63664
CWE: CWE-284
CVSS: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Incorrect access control in the /api/v1/conversations/*/messages API of GT Edge AI Platform before v2.0.10-dev allows unauthorized attackers to access other users' message history with AI agents.


Mitigations:

Architectural layers (MAESTRO):