MaxKB EUVD-2026-84156

Requires an authenticated MaxKB account (<=2.10.3-lts) that holds model-read permission in a workspace the attacker controls, plus knowledge of a valid model_id belonging to a victim workspace. The flaw is reachable specifically through the model parameter form route, where ModelSerializer.ModelParams queries the Model by id without including workspace_id, so the path-workspace authorization check is bypassed at the object layer. Limiting factors: no unauthenticated access (PR:L), impact confined to reading/overwriting model_params_form and thereby the defaults of workflows consuming that model, and practical exploitation depends on a multi-workspace/multi-tenant deployment and the attacker learning or guessing a victim model_id. No fixed version is available, so the only mitigations are access restriction and workspace isolation.

This is a genuine but bounded-severity issue best treated as a moderate-priority patch-when-available item rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L, 7.4) is network-reachable and low-complexity, but crucially requires PR:L - the attacker must already hold an authenticated MaxKB account with model-read permission in a workspace they control. The scope change (S:C) and the split Low confidentiality/integrity/availability impacts correctly capture that the damage crosses a workspace boundary yet is limited to a single object type (model_params_form) rather than full compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automated exploitation; the elevated 7.4 is driven by the scope change, not by real-world weaponization. The realistic risk is targeted tampering by an insider or a low-privilege tenant in a multi-workspace deployment, not mass exploitation. Note the input Tag 'Authentication Bypass' conflicts with the described mechanism - this is a cross-workspace authorization/IDOR flaw (CWE-639), not an authentication bypass, since the attacker is fully authenticated. No fixed version exists at time of review, which raises exposure duration but does not change the gated, insider-leaning threat profile.

A tenant with a legitimate low-privilege MaxKB account and model-read permission in their own (attacker-controlled) workspace enumerates or learns a victim model_id belonging to a different workspace. They issue a model parameter form request supplying that foreign model_id; because ModelSerializer.ModelParams loads and saves the Model by id alone without scoping to workspace_id, they read or overwrite the victim's model_params_form, silently altering defaults used by the victim's workflows. No public exploit code was identified at time of analysis.