CVE-2026-77525 MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path applicationid but load records using global chatid and chatrecordid values without confirming that the chat belongs to the authorized application. A normal user in the...

CVE-2026-77525

MaxKB , an open-source enterprise AI assistant, contains an authorization flaw in its management chat-record routes (affects 2.10.2-lts and earlier ). The routes authorize based on the path application_id but load ChatRecord objects using global chat_id and chat_record_id values without verifying...

CVE-2026-77525 MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path applicationid but load records using global chatid and chatrecordid values without confirming that the chat belongs to the authorized application. A normal user in the...

CVE-2026-82284: Authorization Bypass Through User-Controlled Key

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

CVE-2026-59714

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-59714: Missing Authorization

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2025-0741

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chatid" of the POST request "/embedai/chats/sendmessage"...

CVE-2025-0741

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chatid" of the POST request "/embedai/chats/sendmessage"...

CVE-2025-0741 Improper Access Control vulnerability in EmbedAI

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chatid" of the POST request "/embedai/chats/sendmessage"...