CVE-2026-125397: NocoBase plugin-ai 2.1.0 through 2.2.41 Authorization Bypass via Sub-Agent Username Override
NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run ungranted AI employees with their tools and permissions, and get-ai-employee to read their prompts and tool configuration.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The attack requires only low privileges and no user interaction.
What access can an attacker gain through the bypass?
An attacker can invoke AI employees that were not assigned to them through dispatch-sub-agent-task, using those employees' tools and permissions. They can also use get-ai-employee to read the unassigned employees' prompts and tool configuration.
Which versions are affected?
NocoBase plugin-ai versions 2.1.0 through 2.2.41 are affected.