CVE-2026-82290: Chainlit Feedback Endpoints Missing Ownership Validation
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to send requests to the affected PUT or DELETE feedback endpoints. They also need a feedback identifier belonging to another user; exploitation has high attack complexity.
What is the impact of a successful exploit?
An attacker can modify or delete feedback records created by other users. This can corrupt the human-rating data used for model evaluation, affecting integrity but not confidentiality or availability.
Are default deployments affected?
The available data identifies Chainlit through version 2.12.0 as affected, but does not state whether the vulnerable feedback endpoints are enabled or reachable in a default deployment.
How can teams check for possible exploitation?
Review feedback update and deletion activity for records changed or removed by accounts other than their owners. The issue concerns PUT and DELETE requests where arbitrary feedback identifiers were supplied.