CVE-2026-82290 Chainlit Feedback Endpoints Missing Ownership Validation

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...

CVE-2026-82290

Chainlit through version 2.12.0 fails to validate ownership of feedback records in its PUT and DELETE endpoints. The root cause is a missing ownership check, allowing authenticated attackers to delete or modify other users' feedback by supplying arbitrary feedback identifiers. The practical conse...

EUVD-2026-67821

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...