CVE-2026-77523 Overview
MaxKB is an open-source AI assistant for enterprise environments. CVE-2026-77523 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] affecting MaxKB version 2.10.3-lts and earlier. The model parameter form route authorizes the workspace path, but ModelSerializer.ModelParams loads and saves a Model by id alone without validating workspace_id in the query. An authenticated user with model read permission in an attacker-controlled workspace can supply a known victim model_id to read or overwrite another workspace's model_params_form. No fixed version is available as of publication.
Critical Impact
Authenticated attackers can read or overwrite model parameter defaults across workspace boundaries, potentially altering workflows that rely on those defaults.
Affected Products
- MaxKB 2.10.3-lts
- MaxKB versions prior to 2.10.3-lts
- 1Panel-dev MaxKB open-source AI assistant
Discovery Timeline
- 2026-09-21 - CVE-2026-77523 published to NVD
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-77523
Vulnerability Analysis
The flaw resides in the model parameter form endpoint. While the route enforces authorization scoped to a workspace path parameter, the underlying ModelSerializer.ModelParams serializer retrieves the target Model object using only its primary key (id). The serializer never cross-references the workspace path parameter against the model's true owning workspace. This decoupling of authorization context from data lookup produces a classic broken object-level authorization flaw [CWE-639].
An attacker who legitimately belongs to Workspace A can craft requests that reference a model_id owned by Workspace B. The route accepts the request because the attacker is authorized within Workspace A, and the serializer executes read or write operations against the victim's model.
Root Cause
The root cause is a missing tenancy check in the data access layer. The workspace boundary exists in routing and permission checks but is not propagated into the database query. Any object retrieval that omits the tenant identifier from its WHERE clause allows cross-tenant reference by primary key.
Attack Vector
Exploitation requires network access to the MaxKB API and valid credentials with model read permission in any workspace controlled by the attacker. The attacker enumerates or obtains a victim model_id, then issues a request to the model parameter form route in their own workspace context while substituting the victim's model_id. The server returns or overwrites the victim's model_params_form, altering downstream workflow defaults.
Refer to the GitHub Security Advisory GHSA-g888-8cvh-9284 for full technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-77523
Indicators of Compromise
- Requests to the model parameter form route where the workspace path parameter and the resolved model's owning workspace do not match.
- Unexpected modifications to model_params_form values on models the requesting user does not own.
- API access patterns showing a single authenticated principal referencing model_id values across multiple workspaces.
Detection Strategies
- Instrument the model parameter form handler to log the requesting user, workspace path parameter, target model_id, and the model's true owning workspace_id.
- Alert on any request where the path workspace differs from the model's owning workspace.
- Review audit logs for bulk or sequential model_id enumeration against the endpoint.
Monitoring Recommendations
- Baseline normal per-user access patterns to model configuration endpoints and flag deviations.
- Track write operations to model_params_form and correlate to workflow execution changes downstream.
- Ingest MaxKB application logs into a centralized SIEM for cross-workspace anomaly correlation.
How to Mitigate CVE-2026-77523
Immediate Actions Required
- Restrict access to MaxKB workspaces to trusted authenticated users only, since exploitation requires valid workspace membership.
- Review and audit recent model_params_form values for unauthorized changes across all workspaces.
- Reduce the number of users granted model read permission in shared or lower-trust workspaces until a patch is available.
Patch Information
No fixed version is available as of this review. Monitor the 1Panel-dev MaxKB Security Advisories page for release announcements and apply the vendor patch as soon as it is published.
Workarounds
- Apply a reverse proxy or WAF rule that inspects requests to the model parameter form route and rejects any where the referenced model_id does not belong to the workspace in the URL path.
- Limit MaxKB API exposure to internal networks or authenticated VPN users to reduce the attack surface.
- Segregate sensitive model configurations into dedicated workspaces with strictly limited membership until the vendor issues a fix.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
