EUVD-2026-115903Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with read:knowledge for one project
-
DeliveryCall /api/knowledge/query or /api/research/answer
-
ExploitSet context.project_id to another project
-
ExecutionBypass _metadata_allowed scope check
-
ImpactRead other project's knowledge chunks
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Object-level authorization, IDOR prevention
|
| Exploitation Conditions | Requires a valid authenticated account in the target's tenant holding the read:knowledge scope for at least one project (PR:L); the attacker then supplies another project's project_id via context.project_id on GET /api/knowledge/query or POST /api/research/answer to read that project's knowledge chunks. Exploitation is strictly limited to projects within the SAME tenant - it does not cross tenant isolation boundaries - and impact is confined to reading knowledge content (confidentiality only; no modification). The attacker must also know or guess a valid in-tenant project_id, which is the attack requirement reflected by AT:P. |
| Impact | This is a genuinely low-priority issue, and the signals agree rather than conflict. The CVSS 4.0 base score is 2.3 (Low), with a vector showing network reach (AV:N) but constrained by an attack requirement (AT:P), low privileges required (PR:L, i.e. an authenticated account), and only low confidentiality impact (VC:L) with no integrity or availability impact. The vuln.today decision label is 'monitor,' the lowest urgency tier, which is consistent with the low CVSS. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or probable widespread exploitation. The flaw is a classic CWE-639 authorization-bypass / IDOR: an authenticated tenant user can read knowledge belonging to other projects within the SAME tenant by supplying a project_id - it does not cross tenant boundaries, which materially caps the blast radius. A vendor patch (commit 4669c93) is available, and the fix is confirmed by the source diff, which tightens _metadata_allowed so a caller-supplied project id can only narrow, never widen, access. No active exploitation signals are present; treat this as a routine same-tenant confidentiality fix rather than an emergency. |
| Exploit ScenarioDerived | An analyst granted read:knowledge access to one audit project within a tenant calls GET /api/knowledge/query (or POST /api/research/answer) and sets context.project_id to a colleague's project within the same tenant. Because _metadata_allowed treated a caller-supplied project_id as sufficient authorization, the API returns knowledge chunks from that other project, leaking cross-project audit data. No public exploit code is identified; exploitation requires a valid same-tenant account and knowledge of (or guessing of) another project_id. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
AuditPilot's knowledge-retrieval endpoints let an authenticated user who holds read:knowledge on a single project read knowledge chunks belonging to other projects in the same tenant by supplying a foreign context.project_id to GET /api/knowledge/query or POST /api/research/answer. Builds of the intelligent-audit-system repository prior to commit 4669c93f3a7403a0e242bef14d771beef0b4356b are affected; the exposure is confidentiality-only and stays inside one tenant, and the attacker must know or guess a valid in-tenant project identifier before the bypass returns anything. No public exploit code and no CISA KEV entry were identified at time of analysis, and the low severity score is consistent with the monitor priority label assigned to this CVE.
RemediationAI
Update to commit 4669c93f3a7403a0e242bef14d771beef0b4356b or any later commit on the intelligent-audit-system repository; the project does not appear to publish tagged releases, so upstream fix availability is confirmed at the commit level only and no versioned release has been independently confirmed. The patch is the complete fix because it rewrites the authorization gate itself, making membership in read:knowledge scopes mandatory before a caller-supplied project_id can filter results, and no separate configuration toggle is described in the available sources. If the commit cannot be deployed immediately, the only lever the evidence supports is reducing who holds the scope the exploit depends on: narrow read:knowledge grants so that users are not given the permission across projects they do not need, accepting that this breaks cross-project knowledge queries for those accounts, and log context.project_id from GET /api/knowledge/query and POST /api/research/answer alongside the caller's principal project memberships so out-of-scope identifiers are visible - that monitoring gives detection only, not prevention, and the bypass remains reachable until 4669c93 is applied. Applying the commit is the only complete remediation identified.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-639 (Authorization Bypass Through User-Controlled Key), a classic insecure-direct-object-reference pattern in the retrieval-augmented generation layer. In rag/agentic_rag.py the _metadata_allowed() gate compares a knowledge chunk's document_project metadata against the set of projects carried in the caller's read:knowledge scope (principal_projects), and separately honours a caller-supplied requested_project taken from context.project_id. Before the fix, when requested_project was present the function only checked document_project != requested_project and returned False otherwise, short-circuiting past the principal_projects membership test entirely - so any project id supplied by the caller was trusted as an authorization boundary rather than treated as a filter. The fix at commit 4669c93 reorders the logic so that the principal's membership check runs first and a caller-supplied project id can only narrow the result set, never widen it. The two request handlers that feed context.project_id into this path live in web/main.py (lines 1197-1206) and are exposed as GET /api/knowledge/query and POST /api/research/answer, which is what makes the bug reachable over the network. The CVSS 4.0 vector marks AT:P, reflecting that the attacker must already possess a valid project identifier within the tenant; the assessed impact is limited to confidentiality of retrieved knowledge text, with no write, integrity, or availability effect and no crossing of tenant isolation boundaries.
Know when Intelligent Audit System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Authenticated same-tenant user (PR:L) exploits an IDOR over the network (AV:N) to read other projects' knowledge, yielding low confidentiality impact only (C:L) with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/query or POST /api/research/answer to retrieve same-tenant project knowledge chunks.
Threat Intelligence Overview
NVD
CVE.org
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB