AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

CursorGHSA-rjmc-526x-8653

IDOR in Usage Events API Lets Users Access Teammates' Activity Data

Cursor

Published Jun 19, 2025

Medium4.3
Fix: upgrade to 2025-06-17 or later
GitHub advisory

Summary

An IDOR (Insecure Direct Object Reference) vulnerability in the /api/dashboard/get-filtered-usage-events website endpoint allowed any authenticated team member to access other teammates' usage data by modifying the userId in the request.

Impact

This flaw exposes private usage data of any teammate, including timestamps, usage numbers, and model choices.

Remediation

The endpoint has been restricted as of 2025-06-17 to only administrators for users on teams.

Affected versions

PackageAffectedFixed in
Cursor API
Product
< 2025-06-172025-06-17
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-639

More Cursor advisories

All Cursor
Medium 6.4Aug 1, 2025Bypassing allow list to execute an arbitrary commandCVE-2025-54131fixed in 1.3Medium 4.4Aug 1, 2025Arbitrary Image Fetch in Mermaid Diagram ToolCVE-2025-54132fixed in 1.3MediumAug 1, 2025MCP Install Deeplink Did Not Show Arguments on User-DialogCVE-2025-54133fixed in 1.3High 7.2Aug 1, 2025Modification of MCP Server Definitions Bypasses Manual Re-approvalCVE-2025-54136fixed in 1.3Medium 4.3Jun 19, 2025IDOR in Usage API Leading to Unauthorized Data ExposureGHSA-c43p-6fv2-6gr2fixed in 2025-06-17Medium 5.9Jun 11, 2025Potential Information Leakage using JSON schema in Cursor AgentCVE-2025-49150fixed in 0.51.0