CVE-2026-79917: MaxKB Authentication Bypass Vulnerability

CVE-2026-79917 Overview

CVE-2026-79917 is a broken access control vulnerability [CWE-285] in MaxKB, an open-source enterprise AI assistant. The flaw exists in the POST /chat/api/{application_id}/chat/{chat_id}/share_chat endpoint across versions 2.7.0 through 2.10.4-lts. The endpoint confirms that a conversation exists but fails to verify ownership by the authenticated chat_user_id or the application bound to the caller's token. An attacker holding any valid chat token and a victim chat_id can generate an unauthenticated public ChatShareLink and create PublicFileAccess state exposing associated files without credentials.

Critical Impact
Attackers can expose arbitrary victim conversations and their associated files through public share links, with no available revoke path and no fixed version at time of publication.

Affected Products

MaxKB 2.7.0 through 2.10.4-lts
MaxKB deployments exposing the share_chat endpoint
Enterprise AI assistant instances using vulnerable chat token flow

Discovery Timeline

2026-09-21 - CVE-2026-79917 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-79917

Vulnerability Analysis

The defect lies in MaxKB's authorization logic for creating shareable chat links. The share_chat handler performs an existence check on the chat_id parameter but omits ownership validation. Any authenticated caller with a valid chat token can therefore pass a victim's chat_id and receive a successful response.

The endpoint then provisions two persistent artifacts. First, it creates a ChatShareLink object accessible without authentication. Second, it establishes PublicFileAccess state that exposes files attached to the target conversation. The advisory notes that no revoke path exists for these artifacts once created.

Root Cause

The root cause is missing authorization [CWE-285]. The handler validates resource existence but does not correlate the target chat_id with the caller's chat_user_id or the application_id bound to the caller's token. This omission collapses the tenancy boundary between chat users within the same MaxKB instance.

Attack Vector

Exploitation requires network access to the MaxKB API, a valid chat token from any user, and knowledge of a victim chat_id. The attacker issues a POST request against the share_chat endpoint with the victim's chat_id, then distributes the returned public link. Recipients retrieve the conversation contents and associated files without authentication. The vulnerability affects confidentiality directly and integrity indirectly through the persistent public state that cannot be revoked.

See the GitHub Security Advisory for the vendor's technical description.

Detection Methods for CVE-2026-79917

Indicators of Compromise

Unexpected ChatShareLink records referencing conversations owned by users other than the creator
New PublicFileAccess entries associated with sensitive attachments
POST requests to /chat/api/{application_id}/chat/{chat_id}/share_chat where the chat_id does not belong to the authenticated chat_user_id

Detection Strategies

Correlate share_chat requests against ownership metadata in the MaxKB database and flag mismatches
Alert when a single chat token issues share requests across multiple distinct application_id values
Baseline share link creation volume per user and surface statistical outliers

Monitoring Recommendations

Log all requests to the share_chat endpoint with authenticated user identity, target chat_id, and response status
Monitor anonymous access patterns to public share URLs for spikes indicating exfiltration
Audit PublicFileAccess table growth and review new entries against expected sharing workflows

How to Mitigate CVE-2026-79917

Immediate Actions Required

Restrict network exposure of MaxKB instances to trusted users pending an upstream fix
Audit existing ChatShareLink and PublicFileAccess records and manually remove unauthorized entries at the database layer
Rotate chat tokens for any users suspected of unauthorized access

Patch Information

No fixed version is available as of the advisory publication date. Monitor the MaxKB GitHub Security Advisory GHSA-m8gr-554p-8r82 for patch releases.

Workarounds

Block or reverse-proxy the POST /chat/api/{application_id}/chat/{chat_id}/share_chat endpoint until a vendor patch is available
Disable public share functionality at the application layer where feasible
Apply a web application firewall rule that validates chat_id ownership against session context before allowing the request

bash

# Example NGINX rule to block the vulnerable endpoint
location ~ ^/chat/api/[^/]+/chat/[^/]+/share_chat$ {
    if ($request_method = POST) {
        return 403;
    }
}