CVE-2026-85669: potpie through 2.0.0 Missing Ownership Check via code-changes sync
Published Sep 4, 2026
·Updated
potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversationid}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending changes.
Affected Software
1 affected component
npm/potpie<=2.0.0
Event History
Sep 4, 2026
CVE Published
via MITRE·02:32 PM
Data Sourced
via MITRE·02:32 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be authenticated and able to make requests to the affected endpoint. They also need a valid conversation ID belonging to another user.
2
What is the impact of successful exploitation?
An attacker can write arbitrary file changes into another user's conversation, modifying that conversation's pending changes without authorization.
3
Are unauthenticated deployments exposed?
The described attack requires authentication, so an unauthenticated attacker cannot exploit it based on the available information.