CVE-2026-82290: Chainlit Authentication Bypass Vulnerability

CVE-2026-82290 Overview

CVE-2026-82290 is an authorization flaw in Chainlit through version 2.12.0. The framework's feedback PUT and DELETE endpoints do not validate that the authenticated caller owns the feedback record identified in the request. Any authenticated user can supply an arbitrary feedback identifier and modify or delete another user's feedback. The defect corrupts human-rating data that downstream teams rely on for large language model (LLM) evaluation. The issue is classified as Authorization Bypass Through User-Controlled Key [CWE-639].

Critical Impact
Authenticated attackers can tamper with or destroy feedback records belonging to other users, undermining the integrity of model-evaluation datasets collected through Chainlit applications.

Affected Products

Chainlit versions up to and including 2.12.0
Applications embedding the Chainlit backend server.py feedback routes
LLM evaluation pipelines that consume Chainlit human-feedback data

Discovery Timeline

2026-08-28 - CVE-2026-82290 published to the National Vulnerability Database (NVD)
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82290

Vulnerability Analysis

Chainlit exposes REST endpoints for creating, updating, and deleting user feedback attached to chat interactions. The PUT and DELETE handlers accept a feedback identifier from the request but never verify that the authenticated session owns the referenced record. An attacker with any valid account can iterate or guess feedback identifiers and issue write or delete operations against records belonging to other users.

The direct impact is loss of integrity for feedback data. Because the endpoints require authentication and only affect the integrity of feedback records, confidentiality and availability of the wider application are not directly compromised. However, integrity loss in human-rating datasets can silently degrade downstream model evaluation, reinforcement learning from human feedback (RLHF) pipelines, and safety-tuning workflows that consume this data.

Root Cause

The root cause is a missing ownership check in the feedback update and delete handlers within backend/chainlit/server.py. The code trusts the client-supplied feedback identifier and performs the database operation using session authentication alone, without comparing the record owner to the authenticated principal. This is a textbook Insecure Direct Object Reference (IDOR) pattern captured by CWE-639: Authorization Bypass Through User-Controlled Key.

Attack Vector

Exploitation requires an authenticated account on the target Chainlit deployment and network reach to its HTTP interface. The attacker enumerates or obtains a target feedbackId and issues an HTTP PUT to overwrite the feedback payload or an HTTP DELETE to remove it. No user interaction on the victim side is required, and the operation succeeds because the server does not correlate the record's forId/owner field with the caller's identity. Full technical details are documented in the VulnCheck advisory and Chainlit Issue #2975.

Detection Methods for CVE-2026-82290

Indicators of Compromise

Unexpected PUT /feedback or DELETE /feedback requests where the authenticated user does not match the feedback record owner in application logs.
Sudden drops in feedback record counts or shifts in aggregate rating distributions used for model evaluation.
Repeated sequential access to numeric or guessable feedbackId values from a single authenticated session.

Detection Strategies

Instrument the Chainlit backend to log the caller identity alongside the feedback record owner for every PUT and DELETE on /feedback, and alert on mismatches.
Perform periodic integrity audits comparing feedback ownership fields in the database against the users who last modified each record.
Add web application firewall (WAF) rules that flag high-volume feedback mutation requests from single sessions.

Monitoring Recommendations

Ship Chainlit application and reverse-proxy access logs to a centralized analytics platform for behavioral baselining of feedback endpoint usage.
Track authentication events correlated with feedback mutations to identify accounts issuing anomalous cross-user modifications.
Monitor the Chainlit GitHub repository for patched releases and re-verify deployed versions after upgrades.

How to Mitigate CVE-2026-82290

Immediate Actions Required

Inventory all Chainlit deployments and identify instances running version 2.12.0 or earlier.
Restrict feedback endpoints to trusted networks or authenticated internal users while a fix is applied.
Snapshot current feedback data so that any tampering discovered later can be reconstructed and audited.
Rotate or invalidate long-lived session tokens if abuse is suspected.

Patch Information

No fixed version is referenced in the NVD record at the time of publication. Track the upstream Chainlit GitHub repository and Issue #2975 for a released fix, and consult the VulnCheck advisory for remediation guidance. Once a patched release is available, upgrade all affected deployments and confirm the fix by attempting a cross-user feedback modification against a staging instance.

Workarounds

Apply a local patch to backend/chainlit/server.py that loads the target feedback record and verifies its owner matches the authenticated user before executing PUT or DELETE operations.
Front the Chainlit application with a reverse proxy or API gateway that enforces per-user rate limits on feedback mutation endpoints.
Disable end-user feedback collection entirely if the feature is not required by the deployment.

bash

# Example reverse-proxy guard: reject feedback mutations from unauthenticated or unknown sessions
# nginx snippet
location ~ ^/feedback {
    limit_except GET POST {
        # Require an internal auth subrequest that validates session ownership
        auth_request /_auth/verify_feedback_owner;
    }
    proxy_pass http://chainlit_backend;
}