MaxKB EUVD-2026-84162

Exploitation requires an authenticated normal workspace user account on the MaxKB instance (PR:L) plus knowledge of a valid victim document or paragraph UUID. The attacker uses an operate route on a knowledge base they legitimately own (attacker-controlled knowledge_id in the path) while supplying the victim's document_id/paragraph_id in the body/parameters; the routes authorize only knowledge_id and never verify the object belongs to that knowledge base. Affected versions are 2.0.0 through 2.10.2-lts. Limiting factors: attacker must already have a valid account in the same MaxKB deployment, must know or discover a victim object UUID, and no fixed version is available (mitigation currently requires restricting untrusted multi-tenant access or applying workarounds). No user interaction is required (UI:N).

This is a broken-object-level-authorization / IDOR flaw (CWE-639) whose real-world risk is moderate and firmly gated by authentication. The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N (5.4, Medium) is internally consistent with the description: network-reachable, low complexity, but requiring an authenticated low-privilege workspace user (PR:L). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The impact is deliberately scoped to C:L/I:L - the attacker can read AND modify another user's knowledge-base documents/paragraphs, but not delete/deny service (A:N) and not achieve full disclosure of the whole system, which is why each impact axis is Low rather than High. Two data caveats: (1) the input Tag 'Authentication Bypass' conflicts with the description and CWE-639 - this is an authorization (object-ownership) failure by an already-authenticated user, not an authentication bypass; (2) no fixed version exists as of this review, which raises operational urgency for exposed multi-tenant deployments even though the CVSS is only Medium. Net: a real, patch-pending priority for organizations running shared-workspace MaxKB with untrusted internal users, but not a mass-exploitation, high-CVSS emergency.

A legitimate low-privilege user of a shared MaxKB instance who owns their own knowledge base obtains (or guesses/observes) the UUID of a document or paragraph belonging to a victim's knowledge base. They issue an operate request whose path references their OWN knowledge_id but whose document_id/paragraph_id points at the victim's object; because only knowledge_id is authorized, the server reads or overwrites the victim's content. No public exploit code was provided, and exploitation requires an authenticated account plus knowledge of a valid victim object UUID.