Description

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T20:20:20.680Z",
  "pubdate": "2026-08-28T20:20:20.680Z",
  "executiveSummary": "Chainlit versions up to 2.12.0 contain an Insecure Direct Object Reference (IDOR) vulnerability within its feedback management API. The flaw stems from a failure to validate user authorization when processing PUT and DELETE requests targeting feedback records.\nThe vulnerability allows an authenticated attacker to manipulate or destroy feedback data belonging to other users by supplying arbitrary identifiers. This risk has significant implications for environments relying on human-rating data for LLM fine-tuning or model evaluation, as the integrity of the feedback dataset can be compromised.\nExploitation requires the attacker to hold an active authenticated session. No elevated privileges are required, as the application fails to verify ownership of the resource during the modification or deletion process. This architectural oversight permits unauthorized data modification across the entire application feedback repository.",
  "technicalDetails": "The vulnerability is located within the feedback API endpoints responsible for handling modifications (PUT) and deletions (DELETE) of feedback records. The core issue is a lack of server-side authorization checks, specifically failing to perform access control verification between the authenticated user's session identifier and the owner of the requested feedback resource.\nIn a standard deployment of Chainlit, feedback records are assigned unique identifiers. When a client issues a request to modify or delete a record, the server-side logic processes the identifier provided in the request URI without verifying if the requesting user is the original creator or possesses administrative authority over the resource. This is a classic Insecure Direct Object Reference (IDOR) pattern.\nThe attack flow proceeds as follows: First, an attacker authenticates to the Chainlit application to obtain a valid session token. Second, the attacker interacts with the application to identify valid feedback IDs, often through observing legitimate traffic or iterating through predictable ID structures. Third, the attacker crafts a malicious PUT or DELETE request using an identified target ID not belonging to their account. Because the backend service performs no authorization validation, the application process executes the update or delete operation on the target resource.\nThis vulnerability is present in all versions of Chainlit through 2.12.0. The lack of validation occurs within the component responsible for processing feedback-related HTTP methods. Because the authentication middleware confirms the user is logged in but fails to enforce granular object-level access control, the system is susceptible to data corruption and unauthorized record removal.\nThe post-exploitation impact is primarily concentrated on data integrity. In contexts where feedback metrics are aggregated to influence model fine-tuning, automated evaluations, or RAG performance metrics, an attacker can silently manipulate data points. By deleting or modifying existing ratings, an attacker can bias evaluation results, degrade the quality of downstream model tuning, or cause systemic denial of service regarding accurate model evaluation metrics."
}