CVE-2026-77520

MaxKB (open-source enterprise AI assistant) in versions 2.10.2-lts and earlier has an authorization flaw in the homepage application question-ranking endpoint. A normal user in the same workspace can extract another user's application_id when the victim's published application has ranking activit...

CVE-2026-77520 MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's applicationid from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range...

EUVD-2026-84197

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's applicationid from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range...

PT-2026-96256

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.2-lts Description A normal user within the same workspace can obtain another user's application id via the homepage application question-ranking endpoint. This occurs if the victim's published application has ranki...