ChatOllama CVE-2026-111702

Exploitation requires network reachability to a ChatOllama instance (through commit 96c3ce5) and that knowledge bases are referenced by predictable sequential integer IDs, which the application does not authorize against the requesting user. The attacker supplies arbitrary IDs to GET /api/knowledgebases/{id} or to the knowledgebaseId parameter of POST /api/models/chat. The supplied CVSS vector states PR:N (no privileges) and UI:N (no interaction); the main limiting factor is whether a given deployment places the API behind network restrictions or a login requirement - defenders should confirm whether their instance enforces authentication, since a typical IDOR presumes at least a valid user session even though the vector asserts none. Impact is read-only disclosure of other users' knowledge-base metadata and retrieved document content; no write or availability impact.

The input provides only a CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H with no integrity or availability impact, base score 8.7, 'High'), reflecting a network-reachable, low-complexity, no-interaction read-only IDOR (CWE-639). No EPSS score is provided, so exploitation probability cannot be quantified. Not listed in CISA KEV and no POC flag is set, so exploitation status is 'no public exploit identified at time of analysis' - however, a detailed third-party technical writeup (hackmd.io) documents the exact vulnerable endpoints and the sequential-id enumeration method, meaning the barrier to building a working exploit is effectively trivial despite no packaged POC. No SSVC decision data is supplied. On balance this is a genuine confidentiality risk (trivial, automatable enumeration of sequential IDs leaking other users' private knowledge-base metadata and retrieved document content) but is tempered by the product's small real-world footprint: it affects a niche self-hosted open-source project, not widely deployed enterprise software. The high CVSS reflects ease-of-exploit and data sensitivity, not breadth of exposure. One caveat: CWE-639 IDOR normally presumes an authenticated foothold, yet the supplied vector states PR:N; verify whether the targeted ChatOllama instance enforces login, as this materially changes who can exploit it.

A remote attacker reachable to a ChatOllama instance iterates sequential integer knowledge-base IDs against GET /api/knowledgebases/{id} (or via the knowledgebaseId parameter of POST /api/models/chat) and harvests metadata and retrieved document content belonging to other users' private knowledge bases. Because the attack is low-complexity and requires no user interaction, it is easily scriptable to enumerate every knowledge base on the server. No packaged exploit is published, but a public technical writeup details the exact vulnerable endpoints and method.