Description

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and fails to validate file ownership, enabling attackers to retrieve indexed content chunks from victim files through crafted POST requests.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T15:17:47.397Z",
  "pubdate": "2026-09-04T15:17:47.397Z",
  "executiveSummary": "The Chatbot UI application contains an authorization bypass vulnerability within its file retrieval endpoint, characterized as an Insecure Direct Object Reference (IDOR). This flaw stems from the improper implementation of a service-role Supabase client, which suppresses Row-Level Security (RLS) policies. By manipulating file UUIDs in POST requests, an authenticated attacker can successfully exfiltrate private file contents belonging to other users. The vulnerability poses a significant risk to data confidentiality, as it bypasses intended access controls to allow unauthorized cross-user data exposure. Exploitation requires an active authenticated session, but the simplicity of the attack vector—targeting the retrieval mechanism—lowers the barrier for malicious actors to harvest sensitive information from the application's file storage layer.",
  "technicalDetails": "The root cause of this vulnerability is the utilization of a high-privileged service-role client within the Chatbot UI retrieval endpoint. In the context of Supabase architecture, a service-role key is intended for administrative backend tasks and possesses the capability to bypass all Row-Level Security (RLS) policies defined on the database tables. When this client is used directly within a user-facing API endpoint without subsequent application-level validation, the database effectively exposes all records irrespective of their ownership associations.\nThe exploitation flow begins with the attacker establishing an authenticated session with the application. Once authenticated, the attacker targets the file retrieval POST endpoint. Instead of providing a UUID belonging to their own account, the attacker supplies the UUID of a target file known or guessed to reside within the system. Because the endpoint relies on the service-role client to query the underlying storage or database table, the system performs the retrieval without verifying if the requesting user ID corresponds to the owner_id or authorized_user_id associated with the requested UUID.\nUpon receiving the request, the backend processes the file UUID using the service-role client, which queries the database for indexed content chunks. The database, instructed by the privileged service-role client to disregard RLS, returns the binary or text content of the target file. The API then returns this sensitive data directly to the attacker. This process effectively converts the retrieval endpoint into an unrestricted file-read oracle.\nThe vulnerability is exacerbated by the design of the retrieval endpoint, which treats the UUID as a trusted identifier rather than a verifiable asset. Post-exploitation, an attacker can iterate through systematically guessed or enumerated UUIDs to conduct bulk data scraping of the entire platform's stored content. Since the application fails to perform a secondary ownership check—such as validating that the session's user identity has an explicit permission entry linked to the requested file UUID—the system remains fundamentally broken. The risk is high as the vulnerability resides in the core logic of content retrieval, directly exposing indexed data segments to any user capable of authenticating with the service."
}