Darkroom4364

**Name of the Vulnerable Software and Affected Versions** Odysseus versions prior to commit bf325f6 **Description** Authenticated non-admin users can manage server-wide embedding backend configuration because certain endpoint management routes verify session authentication but lack an admin authorization guard. An attacker can provide a controlled URL to overwrite the embedding backend in the endpoint configuration file and process environment. This allows the attacker to intercept all subsequent embedding operations—including chat messages, RAG (Retrieval-Augmented Generation) queries, memory entries, and vault text—which are transmitted in plaintext to the attacker-controlled destination. Alternatively, an attacker can delete the endpoint configuration to cause a denial of service for the embedding service for all users. **Recommendations** Update to the version containing commit bf325f6 or later.