CVE-2026-79917

MaxKB , an open-source enterprise AI assistant, has a missing ownership check in versions 2.7.0 through 2.10.4-lts on the endpoint POST /chat/api/{application_id}/chat/{chat_id}/share_chat. The endpoint verifies that a conversation exists but does not verify that it belongs to the authenticated c...