The vulnerability lies in an incorrect access control check that allows an attacker to send a crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint and overwrite any user’s information. This flaw permits the modification of user attributes without proper authorization, potentially enabling credential manipulation, identity spoofing, or other destructive data changes. The weakness is an insecure direct object reference that lets attackers act on data they should not have access to.

Cohere North AI version 1.1.5 is affected. No specific vendor or additional product versions are listed.

The CVSS score of 7.5 indicates a medium‑to‑high severity risk, and the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an internal network or privileged user context with the ability to send HTTP requests to the vulnerable endpoint. If exploited, an attacker could permanently alter user data, undermining data integrity and potentially compromising application security.