CVE-2025-55795 Details

A denial-of-service vulnerability has been identified in the OpenML web application, specifically in version 2.0.20241110 and prior. The issue arises from the use of incremental user IDs and inadequate email ownership verification during email update processes. An authenticated attacker with a lower user ID can change their email address to that of another user with a higher user ID, without proper verification. This action transfers the victim's email to the attacker's account, immediately locking the victim out of their account and disrupting their access. While the vulnerability does not provide direct access to the victim's private data, it causes significant disruption by invalidating the victim's access token and hijacking their email address.

Users are advised to update to a version of OpenML later than 2.0.20241110, where this vulnerability has been addressed.