Description

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using global chat_id and chat_record_id values without confirming that the chat belongs to the authorized application. A normal user in the same workspace who knows the chat_id of a persisted non-debug record for a victim's published application can place it under a separate attacker-owned application path to read victim chat records. An attacker with an owned knowledge base and document can also use add_knowledge to copy victim answers while updating the victim record's improve_paragraph_id_list. No fixed version is available as of this review.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-21T21:17:11.463Z",
  "pubdate": "2026-09-21T21:17:11.463Z",
  "executiveSummary": "MaxKB versions 2.10.2-lts and earlier contain a critical improper authorization vulnerability within its management chat-record routes. The flaw arises because the application validates the application_id during the routing phase but fails to verify that the requested chat_id or chat_record_id corresponds to the validated application scope.\nThis vulnerability allows an authenticated user within a shared workspace to perform cross-application data unauthorized access. By manipulating API requests, an attacker can read sensitive chat records belonging to victim applications. Furthermore, the vulnerability facilitates data manipulation, enabling an attacker to copy victim responses and modify the internal state of victim records via the add_knowledge functionality.\nThe risk to the organization is high, as it compromises the confidentiality and integrity of private AI-assisted enterprise communications. An attacker requires only workspace-level access and knowledge of a valid target chat_id to successfully exploit the system. As of the current assessment, no security patches have been released to address this authorization bypass.",
  "technicalDetails": "The root cause of this vulnerability is an Insecure Direct Object Reference (IDOR) combined with insufficient server-side authorization checks in the application's backend logic. Specifically, the management chat-record routes utilize a hierarchical path structure where the application_id is provided; however, the backend subsequently processes retrieval operations using global identifiers (chat_id and chat_record_id) without performing an ownership verification check against the authenticated user's session or the application context.\nThe exploitation flow proceeds as follows: First, an attacker identifies a valid, non-debug chat_id associated with a victim's published application within the same workspace. Because the system validates the application_id at the route level but fails to enforce relationship constraints between the application_id and the chat_record_id at the data access layer, an attacker can construct a malicious request targeting their own authorized application path while substituting the victim's chat_id into the query parameters.\nThe application backend, seeing a valid application context, proceeds to fetch the record from the global database using the attacker-supplied chat_id. Consequently, the application returns the victim's private chat records to the attacker's interface. Additionally, the vulnerability allows for unauthorized modification; an attacker can exploit the 'add_knowledge' function to append or update victim records by injecting malicious references into the 'improve_paragraph_id_list'. This action not only exposes potentially sensitive internal data but also allows for the corruption of the victim's interaction history.\nThe vulnerable component resides within the management interface routes responsible for chat-record lifecycle management. Since the application fails to perform a cross-reference check (i.e., 'Does this chat_record_id belong to this application_id?'), any user with sufficient privileges to interact with the API in a workspace can perform unauthorized cross-application data extraction. This bypass occurs independently of network exposure, as it relies on the internal API logic of MaxKB versions 2.10.2-lts and earlier. No authentication beyond standard workspace access is required, as the vulnerability is purely a result of broken access control in the application's internal object handling."
}