Restaurant Brands International vulnerabilities
We track 5 vulnerabilities in Restaurant Brands International products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 17, 2025.
Latest Restaurant Brands International vulnerabilities
- 9.9 Critical severity
assistant platform: Use of Client-Side Authentication
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for use of the diagnostic screen.
- 7.7 High severity
assistant platform: Incorrect Resource Transfer Between Spheres
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.
- 9.9 Critical severity
assistant platform: Incorrect Privilege Assignment
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker to obtain a token with administrative privileges for the entire platform via the createToken GraphQL mutation.
- 7.7 High severity
assistant platform: Exposure of Private Personal Information to an Unauthorized Actor
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares personal information among authenticated users.
- 8.6 High severity
assistant platform: Missing Authorization
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" signup API that does not verify user account creation, allowing a remote unauthenticated attacker to create a user account.