CVE-2026-77518

MaxKB (open-source enterprise AI assistant) versions 2.10.2-lts and earlier are affected by an authorization bypass in the MCP tool-detail route, which fails to apply the per-resource authorization check used by the list route. A workspace user who knows another user's active MCP tool_id can retr...

PT-2026-96254

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.10.2-lts Description A normal workspace user can retrieve hidden tools by knowing another user's active tool id within the same workspace. This occurs because the tool-detail route does not implement the per-resource...

Description of the security update for SharePoint Server Subscription Edition: May 12, 2026 (KB5002863)

None None...