CVE-2025-62645

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation...

CVE-2025-62643

The Restaurant Brands International RBI assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages...

CVE-2025-62646

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...

CVE-2025-62642

The Restaurant Brands International RBI assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account...

CVE-2025-62642

The Restaurant Brands International RBI assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account...

CVE-2025-62651

CVE-2025-62651 affects Restaurant Brands International’s assistant platform up to 2025-09-06, which does not implement access control for the bathroom rating interface. The record provides CVSS metrics: CVSS v3.1 base score 5.8 (NVD) / 6.5 (CNA), both indicating Medium severity with network acces...

CVE-2025-62643

The Restaurant Brands International RBI assistant platform through 2025-09-06 transmits passwords of user accounts in cleartext e-mail messages...

Restaurant Brands International assistant platform 安全漏洞

Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in Restaurant Brands International assistant platform version 2025-09-06 and earlier, which stems from unauthenticated user account creatio...

CVE-2025-62648

CVE-2025-62648 affects Restaurant Brands International (RBI) assistant platform versions up to 2025-09-06. The connected CSAF document details multiple vulnerabilities: an unauthenticated account creation path via a signup API, cleartext transmission of passwords in email, a token with administra...

CVE-2025-62649

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for submission of equipment orders...

CVE-2025-62642

The Restaurant Brands International RBI assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account...

CVE-2025-62648

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...

CVE-2025-62650

The Restaurant Brands International RBI assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen...

CVE-2025-62642

The RBI assistant platform (Restaurant Brands International) through 2025-09-06 exposes an unauthenticated account-creation API labeled “Anyone Can Join This Party,” which does not verify user account creation. This allows a remote, unauthenticated attacker to create user accounts. Connected sour...

Restaurant Brands International assistant platform 安全漏洞

Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in Restaurant Brands International assistant platform version 2025-09-06 and earlier, which stems from the global store catalog sharing...

CVE-2025-62644

The Restaurant Brands International RBI assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users...

CVE-2025-62647

CVE-2025-62647 affects the Restaurant Brands International (RBI) assistant platform up to 2025-09-06. The issue is that it can return a JWT that enables calling an API to obtain a signed AWS upload URL for any store path, potentially exposing upload endpoints. This vulnerability is described acro...

CVE-2025-62650

The RBI assistant platform (through 2025-09-06) relies on client-side authentication for key functions, widening attack surface. Connected documents enumerate concrete issues: an unauthenticated remote signup API allows account creation; cleartext transmission of passwords via email; a GraphQL cr...

CVE-2025-62644

The Restaurant Brands International RBI assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users...

CVE-2025-62646

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...