ghostsplice

GhostSplice: cross-channel trust fragmentation attack PoC Proof-of-concept code for GhostSplice , an attack from the ASSET Research Group. The full write-up is "The AI refused to steal the secrets. So we handed it a form.". The idea in plain words AI coding assistants like Cursor, VS Code with...

Measuring and Exploiting Implicit Trust in LLM Tool-Calling Pipelines

The Model Context Protocol MCP enables LLMs to invoke external tools, but every tool interaction exposes the model to attacker-controlled text through multiple input channels tool descriptions, tool results, sampling messages that share a single context window without privilege separation. In thi...

CVE-2026-10542

Mattermost versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 contain a validation flaw in the Playbooks channel action update endpoint . The failure to validate channel action ownership allows a channel manager to update actions belonging to other channels, leadin...

EUVD-2026-77366

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692...

CVE-2026-10542 Playbooks channel action update validation issue

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate channel action ownership which allows channel managers to update actions in other channels via the channel action update endpoint.. Mattermost Advisory ID: MMSA-2026-00692...

CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-59714

CVE-2026-59714 describes a cross-channel message overwrite vulnerability in Open WebUI exposed by the chat-completions path. From v0.9.5 to before v0.10.0, an authenticated user could overwrite a message in a channel they do not belong to by using a channel: chat_id with a caller-supplied message...

CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...

CVE-2026-69114

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete...

CVE-2026-69114 Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete...

CVE-2026-69114

CVE-2026-69114 affects Spacebar Server prior to commit 8d126f4. The cross-channel message deletion vulnerability resides in the single-delete and bulk-delete handlers, which fail to scope message queries to the requested channel. This allows authenticated users with MANAGE_MESSAGES in any control...

EUVD-2026-55792

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete...

CVE-2026-69114

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete...

CVE-2026-69114 Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete...

CVE-2026-69114 Spacebar Server Cross-Channel Message Deletion via Permission Check Bypass

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete...

CVE-2026-69114: Authorization Bypass Through User-Controlled Key

Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail to scope message queries to the requested channel. Authenticated users with MANAGEMESSAGES permission in any controlled channel can delete...

PYSEC-2026-3591 Open WebUI: Private channel messages can be disclosed through cross-channel thread parent_id binding

Summary A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/id/messages/messageid/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without...

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

SummaryAny authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through makechannelemitte...

PYSEC-2026-3605 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through...

CVE-2026-67347

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...