CVE-2026-77520: MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's applicationid from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range and the attacker knows or guesses its name, even though direct application detail and debug-open routes deny access. An attacker who can create and publish a workflow application can place the disclosed identifier in an attacker-owned workflow application-node, trigger that workflow, receive output generated by the victim application, and create durable applicationchat and applicationchatrecord rows under the victim application because save and runtime paths do not verify permission to use the referenced application. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A normal user in the same workspace can exploit it. The victim application must be published and have question-ranking activity in the date range the attacker selects, and the attacker must know or guess the application's name.
What additional access or setup does an attacker need?
The attacker needs permission to create and publish a workflow application. They must add the disclosed application ID to an application-node in their own workflow and trigger that workflow.
What can an attacker do after obtaining an application ID?
They can receive output generated by the victim application through their workflow. They can also create persistent application_chat and application_chat_record rows under the victim application because the save and runtime paths do not verify permission for the referenced application.
Are access controls on the application detail and debug routes sufficient mitigation?
No. Those routes deny direct access, but the homepage application question-ranking endpoint can still disclose the application ID under the described conditions, and workflow application-nodes can then invoke the victim application.
Is a fixed version available?
No fixed version was available as of the review.