CVE-2026-77525: MaxKB AI Assistant Information Disclosure

CVE-2026-77525 Overview

CVE-2026-77525 is a missing authorization vulnerability [CWE-862] in MaxKB, an open-source AI assistant platform for enterprises. The flaw affects versions 2.10.2-lts and earlier. Management chat-record routes authorize the application_id path parameter but load records using the global chat_id and chat_record_id values. The routes never confirm that the referenced chat belongs to the authorized application. A workspace user who knows a victim's chat_id can place it under an attacker-controlled application path and read the victim's chat records.

Critical Impact
Authenticated users in the same workspace can read another user's chat records and tamper with improve_paragraph_id_list through the add_knowledge route.

Affected Products

MaxKB by 1Panel-dev
MaxKB versions 2.10.2-lts and earlier
No fixed version available as of publication

Discovery Timeline

2026-09-21 - CVE-2026-77525 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-77525

Vulnerability Analysis

MaxKB exposes management routes that operate on chat records within an application context. The routes accept an application_id in the URL path and validate the caller's access to that application. However, the underlying data access uses chat_id and chat_record_id parameters that are resolved globally rather than scoped to the authorized application_id. This mismatch allows the authorization check to succeed against one application while the record read or write targets a chat belonging to a different application.

Any authenticated workspace user can exploit this by supplying a victim chat_id under an attacker-owned application path. The server returns records from the victim's published application. A second exploitation path uses the add_knowledge route with an attacker-owned knowledge base and document. The route copies victim answers while updating the victim record's improve_paragraph_id_list, tainting the target record with attacker-controlled references.

Root Cause

The root cause is a broken object-level authorization pattern. The route handlers authorize the path-scoped application_id but never verify that the supplied chat_id and chat_record_id belong to that application. This is a classic insecure direct object reference within a multi-tenant workspace boundary and maps to [CWE-862] Missing Authorization.

Attack Vector

Exploitation requires network access to the MaxKB management API and a low-privileged workspace account. The attacker must know or enumerate a persisted non-debug chat_id for a victim's published application. The attacker then issues management requests under their own application_id while referencing the victim chat_id and chat_record_id. See the GitHub Security Advisory GHSA-7fmh-98f2-2cfg for the affected route details.

Detection Methods for CVE-2026-77525

Indicators of Compromise

Management API requests where the URL application_id does not match the application that owns the referenced chat_id or chat_record_id.
Unexpected modifications to improve_paragraph_id_list on chat records that the requesting user does not own.
add_knowledge calls that link records across application boundaries within the same workspace.

Detection Strategies

Correlate authenticated user identity, requested application_id, and the true owning application of every accessed chat_id in application logs.
Alert on cross-application access patterns where one user reads chat records tied to applications they do not own.
Baseline normal per-user chat-record access volumes and flag deviations that suggest enumeration of chat_id values.

Monitoring Recommendations

Enable verbose access logging on all MaxKB chat-record and add_knowledge management routes.
Forward MaxKB application logs to a centralized SIEM for cross-tenant access analysis.
Review workspace audit trails for accounts that access an unusually broad set of applications.

How to Mitigate CVE-2026-77525

Immediate Actions Required

Restrict MaxKB workspace membership to trusted users until a patched release is available.
Limit exposure of the MaxKB management API to trusted networks and authenticated administrators.
Audit persisted chat records for unauthorized reads and tampered improve_paragraph_id_list values.

Patch Information

No fixed version is available as of this review. Monitor the GitHub Security Advisory GHSA-7fmh-98f2-2cfg for release notes and upgrade guidance from the MaxKB maintainers.

Workarounds

Reduce the number of low-privileged users in shared workspaces that host sensitive applications.
Place the MaxKB management interface behind a reverse proxy that restricts access to administrators.
Rotate or purge sensitive persisted chat records that are not required for production use.

bash

# Example: restrict MaxKB management routes to an admin CIDR at the reverse proxy
location ~ ^/api/application/[^/]+/chat/ {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://maxkb_upstream;
}