EUVD-2026-39992
GHSA-cjxx-6mf8-hqmw
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API endpoint (AV:N) requires authenticated session (PR:L); high complexity (AC:H) because attacker must enumerate valid cross-session identifiers; confidentiality-only impact (C:L), no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown processing of the file backend/controller/conversation_api.py of the component Workflow Checkpoint Restore Handler. Executing a manipulation can lead to improper control of resource identifiers. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.
AnalysisAI
Workflow checkpoint endpoints in ComfyUI-Copilot up to 2.0.28 expose an insecure direct object reference (IDOR) flaw - the restore_workflow_checkpoint and update_workflow_ui handlers in conversation_api.py accept externally supplied version identifiers without verifying that the referenced checkpoint belongs to the requesting session, enabling an authenticated remote attacker to read workflow data owned by other sessions. The CVSS 4.0 score of 2.3 reflects limited confidentiality-only impact and high attack complexity (AC:H) due to the need to enumerate valid cross-session identifiers. A proof-of-concept is publicly available at GitHub issue #149; the upstream fix (PR #150) is pending acceptance and no patched release version has been confirmed.
Technical ContextAI
ComfyUI-Copilot is a Python-based AI workflow assistant plugin for ComfyUI, a node-graph generative AI image pipeline interface. The vulnerable component is backend/controller/conversation_api.py, specifically the restore_workflow_checkpoint and update_workflow_ui async API handlers. Prior to the fix, these handlers called get_workflow_data_by_id(version_id) and update_workflow_ui_by_id(checkpoint_id, ...) - raw database lookups keyed solely on caller-supplied integer identifiers - with no verification that the referenced WorkflowVersion row belongs to the current user's session. CWE-99 (Improper Control of Resource Identifiers) precisely characterizes this root cause: externally controlled identifiers are used directly in data-layer queries without ownership validation. The fix in PR #150 introduces get_workflow_data_by_id_and_session(version_id, session_id) and update_workflow_ui_by_id_and_session(checkpoint_id, session_id, ...), which add a session_id equality filter to all WorkflowVersion ORM queries in both conversation_api.py and workflow_rewrite_tools.py, enforcing session-scoped resource isolation.
RemediationAI
No patched release version has been confirmed - the fix exists only as the open PR #150 at https://github.com/AIDC-AI/ComfyUI-Copilot/pull/150, which administrators can manually apply by cherry-picking or patching the changes to conversation_api.py, workflow_table.py, and workflow_rewrite_tools.py as shown in the diff. Monitor the repository at https://github.com/AIDC-AI/ComfyUI-Copilot/ for a merged release and upgrade immediately upon availability. As compensating controls prior to patching: restrict network access to the ComfyUI-Copilot backend API to a trusted local network or VPN, reducing the remote attack surface (trade-off: limits legitimate remote access); if the deployment supports reverse-proxy configuration, add authorization middleware that enforces session-scoped access checks on the /restore_workflow_checkpoint and /update_workflow_ui routes (trade-off: requires custom proxy logic). These mitigations reduce but do not eliminate insider-threat or shared-session risk.
More in Checkpoint
View allPotentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Path traversal in Hugging Face Accelerate through 1.14.0 exposes two distinct attack outcomes when a user loads a crafte
Out-of-bounds read in the Linux kernel drm/amdkfd CRIU checkpoint path leaks kernel memory to userspace on systems with
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today