CVE-2026-77517

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledgeid in the request path, then query the target Document by documentid or Paragraph by paragraphid without confirming that the object belongs to...

CVE-2026-77517 MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledgeid in the request path, then query the target Document by documentid or Paragraph by paragraphid without confirming that the object belongs to...

CVE-2026-77517

MaxKB (open-source enterprise AI assistant) is affected by a cross-knowledge IDOR vulnerability (CVSS 5.4, MEDIUM) in versions 2.0.0 through 2.10.2-lts . The document and paragraph operate routes authorize only the knowledge_id in the request path, then query the target Document or Paragraph by i...