Restaurant Brands International Assistant vulnerabilities
5 known vulnerabilities in Restaurant Brands International Assistant from Rbi. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.9 Critical severity
assistant platform: Use of Client-Side Authentication
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.
- 7.7 High severity
assistant platform: Incorrect Resource Transfer Between Spheres
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.
- 9.9 Critical severity
assistant platform: Incorrect Privilege Assignment
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.
- 7.7 High severity
assistant platform: Exposure of Private Personal Information to an Unauthorized Actor
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users.
- 8.6 High severity
assistant platform: Missing Authorization
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.