CVE-2026-77520: MaxKB Privilege Escalation Vulnerability

CVE-2026-77520 Overview

CVE-2026-77520 is a missing authorization vulnerability [CWE-862] in MaxKB, an open-source enterprise AI assistant developed by 1Panel-dev. The flaw affects version 2.10.2-lts and earlier releases. An authenticated user within the same workspace can enumerate another user's application_id through the homepage application question-ranking endpoint. The attacker can then reference that identifier inside their own workflow application-node to invoke the victim application and persist unauthorized chat records under the victim's account.

Critical Impact
Authenticated workspace users can invoke and consume other users' published applications, receive their output, and write durable application_chat and application_chat_record rows against victim applications without permission checks.

Affected Products

MaxKB 2.10.2-lts and earlier
1Panel-dev MaxKB open-source AI assistant
No fixed version available as of the advisory publication

Discovery Timeline

2026-09-21 - CVE-2026-77520 published to the National Vulnerability Database
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-77520

Vulnerability Analysis

MaxKB exposes a homepage application question-ranking endpoint that returns activity data across published applications in a workspace. When a victim application has ranking activity within the selected date range, the endpoint discloses its application_id to any authenticated peer who knows or guesses the application name. Direct application detail and debug-open routes correctly deny cross-user access, but the ranking endpoint does not enforce the same authorization boundary.

Once the attacker holds the leaked identifier, the workflow save and runtime paths accept it without verifying that the caller owns or has permission to invoke the referenced application. Executing the attacker's workflow returns output produced by the victim's application. The runtime path also persists new application_chat and application_chat_record rows under the victim application, corrupting audit records and consumption metrics.

Root Cause

The root cause is missing authorization [CWE-862] across two separate code paths. The ranking endpoint discloses identifiers that should remain scoped to the owning user. The workflow save and runtime handlers trust the supplied application_id reference without validating caller entitlement to the target application.

Attack Vector

Exploitation requires network access and low-privilege authenticated credentials within the same MaxKB workspace as the victim. The attacker queries the homepage ranking endpoint using a candidate application name, extracts the disclosed application_id, and embeds it in an attacker-controlled workflow application-node. Triggering that workflow invokes the victim application on the attacker's behalf and writes chat records against the victim identifier. No user interaction from the victim is required.

The MaxKB security advisory GHSA-4w4r-h4x8-mg7h contains the full technical write-up.

Detection Methods for CVE-2026-77520

Indicators of Compromise

Unexpected application_chat or application_chat_record rows referencing an application_id that the requesting user does not own.
Requests to the homepage application question-ranking endpoint enumerating multiple application names in rapid succession from a single user session.
Workflow application-node definitions that reference application_id values belonging to other users in the same workspace.

Detection Strategies

Audit MaxKB database tables for chat records whose creating user identity does not match the owner of the referenced application.
Inspect workflow definitions for cross-user application_id references and flag mismatches between workflow owner and referenced application owner.
Correlate homepage ranking endpoint access patterns with subsequent workflow creation events by the same authenticated principal.

Monitoring Recommendations

Enable verbose application-layer logging for MaxKB workflow save and runtime endpoints and forward events to a centralized analytics platform.
Alert on any authenticated session that invokes workflows referencing applications owned by other users within the workspace.
Track anomalous growth in application_chat_record volume attributed to individual applications for early detection of abuse.

How to Mitigate CVE-2026-77520

Immediate Actions Required

Restrict MaxKB workspace membership to trusted users until a vendor patch is published.
Unpublish sensitive applications that would leak proprietary output if invoked by an unauthorized workspace peer.
Review historical application_chat and application_chat_record data for cross-user contamination and remove fraudulent entries.

Patch Information

No fixed version is available as of this review. Monitor the 1Panel-dev MaxKB security advisories page for release announcements and apply upgrades as soon as the vendor publishes a corrected build.

Workarounds

Segregate high-value MaxKB applications into isolated workspaces so that ranking disclosures cannot reach untrusted users.
Disable workflow application-node functionality for standard users if the deployment supports role-based restriction of this feature.
Apply a reverse proxy rule to block or authenticate access to the homepage question-ranking endpoint until an upstream fix is available.

bash

# Example nginx rule to restrict the ranking endpoint to admin identities
location ~ /api/.*/application/ranking {
    allow 10.0.0.0/24;   # admin subnet
    deny all;
}