Description

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads and saves a Model by id alone without including workspace_id in the query. An authenticated user with model read permission in an attacker-controlled workspace can supply a known victim model_id to read or overwrite the victim's model_params_form in another workspace, potentially altering workflows that use those defaults. No fixed version is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-21T21:17:11.280Z",
  "pubdate": "2026-09-21T21:17:11.280Z",
  "executiveSummary": "MaxKB version 2.10.3-lts and earlier are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability that facilitates unauthorized cross-workspace access.\nThe vulnerability originates from a failure to validate workspace boundaries during the retrieval and modification of model parameters.\nAn authenticated user with basic model read permissions within an attacker-controlled workspace can manipulate model configuration data belonging to other workspaces by providing a target victim's model_id.\nThis flaw allows for unauthorized read and write access to sensitive model parameters, which could lead to the alteration of automated workflows, prompt injection risks, or the subversion of business logic dependent on specific model configurations.\nThe attack requires authentication to the platform, but does not require administrative privileges within the victim's workspace, significantly lowering the barrier for exploitation by malicious insiders or compromised accounts.\nBecause the application logic relies solely on the model_id without verifying the ownership or association of the model with the authenticated user's active workspace, the integrity and confidentiality of model configurations across the multi-tenant environment are compromised.",
  "technicalDetails": "The vulnerability is localized within the ModelParams processing logic of MaxKB. Specifically, the ModelSerializer.ModelParams component is responsible for loading and persisting model configuration forms.\nThe root cause is a failure to enforce multi-tenancy constraints during database queries. While the routing layer correctly identifies the current workspace path, the backend service layer relies exclusively on the model_id parameter provided by the client when interacting with the database.\nWhen a request is submitted to the model parameter form route, the application fails to perform a cross-reference check between the target model_id and the workspace_id associated with the currently authenticated session.\nAn attacker can exploit this by intercepting requests to the parameter update or read endpoints. By substituting the model_id with a known identifier from a different workspace, the attacker bypasses the intended workspace isolation logic.\nThe application processes the request using the provided ID, allowing the user to retrieve sensitive parameter schemas or overwrite existing configurations belonging to another workspace.\nThe attack flow follows these steps: 1. The attacker authenticates to their own workspace and obtains a valid session. 2. The attacker identifies a target model_id (either through enumeration or internal knowledge). 3. The attacker crafts an HTTP request to the model_params_form endpoint, injecting the victim's model_id into the payload. 4. The server, failing to validate the request context against the provided ID, executes the requested CRUD operation on the target resource regardless of ownership.\nThis behavior allows an attacker to manipulate AI agent behaviors or workflow defaults by modifying temperature settings, system prompts, or other model-specific configurations defined in the form. Such modifications result in the execution of compromised models within the victim's environment, leading to potential data exfiltration, system misuse, or disruption of business operations.\nThe flaw affects MaxKB versions 2.10.3-lts and all prior releases. Because the query logic is fundamentally flawed at the serialization level, it represents a systemic issue in how resource authorization is managed across the application's workspace architecture."
}