CVE-2026-77525: MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path applicationid but load records using global chatid and chatrecordid values without confirming that the chat belongs to the authorized application. A normal user in the same workspace who knows the chatid of a persisted non-debug record for a victim's published application can place it under a separate attacker-owned application path to read victim chat records. An attacker with an owned knowledge base and document can also use addknowledge to copy victim answers while updating the victim record's improveparagraphidlist. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A normal user in the same workspace can exploit it if they know the chat_id of a persisted, non-debug chat record belonging to a victim's published application. The attacker does not need elevated privileges, but must be able to use an application path they control.
What information can an attacker access or change?
An attacker can read victim chat records by referencing the victim's chat_id under an attacker-owned application path. If the attacker also owns a knowledge base and document, they can use add_knowledge to copy victim answers and modify the victim record's improve_paragraph_id_list.
Are all chat records affected?
The described exposure applies to persisted non-debug records for published applications. The issue depends on the route authorizing the path application_id without confirming that the supplied chat_id and chat_record_id belong to that application.
Is a fixed release available?
No fixed version was available as of the review. The affected range is MaxKB 2.10.2-lts and earlier.