Description

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id from the homepage application question-ranking endpoint when the published victim application has ranking activity in the selected date range and the attacker knows or guesses its name, even though direct application detail and debug-open routes deny access. An attacker who can create and publish a workflow application can place the disclosed identifier in an attacker-owned workflow application-node, trigger that workflow, receive output generated by the victim application, and create durable application_chat and application_chat_record rows under the victim application because save and runtime paths do not verify permission to use the referenced application. No fixed version is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-21T21:17:10.787Z",
  "pubdate": "2026-09-21T21:17:10.787Z",
  "executiveSummary": "MaxKB versions 2.10.2-lts and earlier are susceptible to an improper authorization vulnerability that allows standard users to bypass access controls on published applications. The vulnerability exists within the application question-ranking endpoint, which inadvertently discloses sensitive application_id identifiers for victim applications that have recent ranking activity.\nBy acquiring these identifiers, an attacker can leverage a secondary, attacker-controlled workflow application to interface with the victim application. This results in the unauthorized execution of the victim application's logic, output leakage, and the creation of unauthorized records within the victim's chat history databases (application_chat and application_chat_record).\nThe risk is critical for multi-tenant enterprise environments, as it allows for cross-user data exposure and persistent unauthorized database writes. Exploitation is facilitated by the lack of server-side validation during the runtime execution path, enabling an attacker to force the application engine to process data through an unintended workflow node. There is currently no official patch available; therefore, organizations must rely on administrative controls and network-level monitoring to detect or mitigate potential abuse of the application-node functionality.",
  "technicalDetails": "The root cause of this vulnerability lies in a critical failure of the application's authorization framework within the server-side runtime and persistence layers. Specifically, the application architecture fails to perform identity and access management (IAM) checks when executing application-node workflows. While direct access to the application detail and debug-open routes is correctly restricted by session-based permissions, the application-node execution path and the data persistence paths (save and runtime) treat the provided application_id as trusted, regardless of the initiator's ownership or access rights.\nThe exploitation flow begins with reconnaissance via the homepage application question-ranking endpoint. An attacker, authenticated as a standard user within the same workspace, queries this endpoint to retrieve the application_id of a victim’s published application. This is successful if the victim application has processed ranking activity within the specified timeframe. Even if the victim application's specific name is obscured, guessing or identifying the target allows the attacker to harvest the internal identifier.\nOnce the identifier is obtained, the attacker utilizes their own authorized workspace account to create a custom workflow application. Within this workflow, the attacker configures an application-node to reference the victim's harvested application_id. When the attacker triggers their own workflow, the backend engine processes the request. Because the runtime path lacks verification logic, the system executes the victim's application logic on behalf of the attacker's workflow.\nThis behavior leads to two significant impacts: first, the attacker receives the output generated by the victim application, resulting in data exfiltration. Second, the save and runtime paths commit the resulting interaction data into the system, creating durable entries in the application_chat and application_chat_record tables linked to the victim's application. Effectively, the attacker gains the ability to interact with and pollute the victim's persistent storage, masquerading as legitimate traffic while bypassing all authorization gates intended to protect isolated application containers. The lack of validation on the application_id parameter across all backend operations (runtime, persistence, and evaluation) suggests a systemic design flaw in the application's orchestration layer."
}