MaxKB CVE-2026-77525

Requires an authenticated normal user account within the SAME MaxKB workspace as the victim (PR:L). The attacker must own at least one application path plus a knowledge base and document (for the add_knowledge integrity vector), and must know a valid global chat_id and chat_record_id of a persisted, non-debug chat record belonging to a victim's published application - these IDs are not surfaced to the attacker's own views and must be discovered or enumerated, which is the primary practical limiter (AC:H). The flaw is that management chat-record routes authorize only the path application_id but load records by global chat_id/chat_record_id without verifying the chat belongs to the authorized application. Not remotely exploitable by an unauthenticated attacker and not exploitable across separate workspaces; no fixed version exists as of review.

This is a genuine but low-priority authorization flaw (IDOR / broken object-level authorization, CWE-862), not the 'Authentication Bypass' its tag implies. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.2) is internally consistent and I broadly agree with it: exploitation is network-reachable but gated behind three real conditions - the attacker must be an authenticated normal user in the SAME MaxKB workspace, must already own an application/knowledge-base path to graft records onto, and must know a valid global chat_id/chat_record_id of a victim's persisted non-debug record (the source of AC:H, since these IDs are not exposed to the attacker's own views and must be discovered/enumerated). Impact is limited to partial confidentiality (reading victim chat records) and partial integrity (add_knowledge copies victim answers and mutates the victim record's improve_paragraph_id_list) - hence C:L/I:L, no availability impact. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided intelligence, so all real-world-exploitation signals are absent. SSVC-wise this reads as low automatability (needs known victim chat_id and same-workspace foothold) with partial technical impact. Net: a real, verifiable authz defect worth patching when a fix ships, but not an urgent or widely-exploitable priority. Note the tag mislabeling and that no fixed version exists yet as of this review - this is a live, unpatched issue.

An authenticated low-privileged user in a shared MaxKB workspace learns the chat_id of a persisted non-debug conversation belonging to a colleague's published application, then re-references that chat_id/chat_record_id under an application path they themselves own, causing the management chat-record route to return the victim's chat contents. Using their own knowledge base and document, they invoke add_knowledge to copy the victim's answers and simultaneously overwrite the victim record's improve_paragraph_id_list. No public exploit code is identified at time of analysis.