CVE-2026-79917

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/applicationid/chat/chatid/sharechat verifies that a conversation exists but does not verify that it belongs to the authenticated chatuserid or to the application bound to the caller's token. An attack...

CVE-2026-79917 MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/applicationid/chat/chatid/sharechat verifies that a conversation exists but does not verify that it belongs to the authenticated chatuserid or to the application bound to the caller's token. An attack...

CVE-2026-79917

MaxKB , an open-source enterprise AI assistant, has a missing ownership check in versions 2.7.0 through 2.10.4-lts on the endpoint POST /chat/api/{application_id}/chat/{chat_id}/share_chat. The endpoint verifies that a conversation exists but does not verify that it belongs to the authenticated c...

CVE-2026-79917 MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/applicationid/chat/chatid/sharechat verifies that a conversation exists but does not verify that it belongs to the authenticated chatuserid or to the application bound to the caller's token. An attack...

EUVD-2026-84158

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/applicationid/chat/chatid/sharechat verifies that a conversation exists but does not verify that it belongs to the authenticated chatuserid or to the application bound to the caller's token. An attack...

CVE-2026-79917 MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/applicationid/chat/chatid/sharechat verifies that a conversation exists but does not verify that it belongs to the authenticated chatuserid or to the application bound to the caller's token. An attack...

CVE-2026-79917: Improper Authorization

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/applicationid/chat/chatid/sharechat verifies that a conversation exists but does not verify that it belongs to the authenticated chatuserid or to the application bound to the caller's token. An attack...

PT-2026-96262

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.7.0 through 2.10.4-lts Description An issue exists where the system verifies the existence of a conversation but fails to confirm if it belongs to the authenticated chat user id or the application associated with the caller's...