EUVD-2026-39983
GHSA-v4h4-747p-qjgx
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires authenticated low-privilege access and high complexity; impact is limited to low integrity with no confidentiality or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected element is the function encrypt_credentials of the file application/security/encryption.py of the component Credential Storage. This manipulation causes insufficient verification of data authenticity. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Credential storage in DocsGPT up to 0.18.0 uses AES-CBC - an unauthenticated cipher mode - allowing a low-privilege authenticated attacker to tamper with encrypted credential blobs without detection, as the application performs no integrity or authenticity verification before decrypting. The root cause (CWE-345) is the absence of authenticated encryption: CBC provides confidentiality only, with no MAC or HMAC binding, and the legacy implementation also lacked any user_id binding, enabling potential cross-user credential replay. Publicly available exploit code exists (CVSS 4.0 E:P), though no confirmed active exploitation (not in CISA KEV); the upstream fix in PR #2331 migrates to AES-GCM with user_id-bound AAD but has not yet been merged.
Technical ContextAI
DocsGPT (CPE: cpe:2.3:a:arc53:docsgpt:*:*:*:*:*:*:*:*) is an open-source AI-powered documentation assistant by arc53. The vulnerable component is application/security/encryption.py, specifically the encrypt_credentials and decrypt_credentials functions. The root cause class is CWE-345 (Insufficient Verification of Data Authenticity): the original code used AES in CBC (Cipher Block Chaining) mode, which is a confidentiality-only construction. CBC provides no integrity guarantee - an attacker with access to a ciphertext blob can flip bits to produce controlled changes in the plaintext, and the decryption routine has no mechanism to detect this. Additionally, the legacy implementation used a 16-byte random IV but bound no additional authenticated data (AAD) to the user_id, meaning a ciphertext encrypted for one user could be replayed under another user's context. The fix in PR #2331 replaces AES-CBC with AES-GCM (an AEAD mode) using a 12-byte nonce, sets AAD to the user_id to cryptographically bind each blob to its owner, and introduces a version byte prefix (0x01) to distinguish new GCM-format blobs from legacy CBC blobs during the migration transition.
RemediationAI
The upstream fix is available in GitHub PR #2331 (https://github.com/arc53/DocsGPT/pull/2331), which replaces AES-CBC with AES-GCM authenticated encryption and adds user_id-bound AAD to prevent cross-user replay. This PR has not yet been merged as of the time of reporting, so no released patched version is independently confirmed - monitor the PR for acceptance and upgrade immediately upon release. The fix maintains backward compatibility: the updated decrypt_credentials falls back to the legacy CBC path for existing stored blobs, so credential re-encryption is not required at upgrade time, though operators should consider re-encrypting stored credentials in GCM format post-upgrade to eliminate legacy CBC exposure. As a compensating control prior to patch availability, restrict authenticated access to DocsGPT endpoints that invoke credential storage operations, limiting the pool of principals who can supply or retrieve credential blobs. Operators should also audit application logs for anomalous decryption failures, which may indicate tampering attempts, though detection reliability is low without the authenticity guarantees that AES-GCM provides.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today