CVE-2026-85669: potpie Auth Bypass Vulnerability

CVE-2026-85669 Overview

CVE-2026-85669 is a missing authorization vulnerability [CWE-862] in potpie through version 2.0.0. The flaw resides in the POST /conversations/{conversation_id}/code-changes/sync endpoint, which fails to verify that the authenticated caller owns the target conversation. Any authenticated attacker who supplies another user's conversation ID can write arbitrary file changes into that conversation, corrupting or replacing pending code modifications belonging to other users.

Critical Impact

Authenticated users can tamper with the pending code changes of any other user's conversation, undermining the integrity of collaborative AI code workflows in potpie.

Affected Products

• potpie (all versions through 2.0.0)
• potpie legacy conversations module (legacy/app/modules/conversations/conversations_router.py)
• Deployments exposing the /conversations/{conversation_id}/code-changes/sync endpoint to multi-tenant users

Discovery Timeline

• 2026-09-04 - CVE-2026-85669 published to the National Vulnerability Database (NVD)
• 2026-09-10 - Last updated in NVD

Technical Details for CVE-2026-85669

Vulnerability Analysis

potpie is an open-source platform that builds AI agents over source code repositories and stores per-user conversations containing generated code changes. The vulnerable endpoint accepts a conversation_id path parameter and a payload describing file changes to sync into that conversation's pending change set.

The handler authenticates the caller but does not compare the caller's user identifier against the owner of the referenced conversation. As a result, the server treats the supplied conversation_id as sufficient authorization. An attacker enumerates or guesses other users' conversation IDs and issues sync requests to overwrite their pending code changes.

The issue is a horizontal privilege escalation limited to integrity. Confidentiality and availability of the target conversation are not directly affected by the endpoint itself, but tampered code changes can propagate downstream when a victim reviews or applies them.

Root Cause

The root cause is a missing authorization check [CWE-862] in the conversations router. The code-changes/sync handler resolves the conversation record by ID and writes the supplied changes without invoking the ownership or access-control helper used elsewhere in the module. See the GitHub Conversations Router Code and GitHub Issue #870 Discussion for the affected code path.

Attack Vector

Exploitation requires a valid potpie account and network access to the API. The attacker sends an authenticated POST request to /conversations/{conversation_id}/code-changes/sync, substituting a victim's conversation ID and a body containing attacker-controlled file paths and contents. No user interaction is required from the victim. Details are documented in the VulnCheck Advisory for PotPie.

No verified proof-of-concept code has been published. The vulnerability mechanism is fully described in the referenced advisory and issue tracker.

Detection Methods for CVE-2026-85669

Indicators of Compromise

• Requests to POST /conversations/{conversation_id}/code-changes/sync where the authenticated user ID does not match the conversation owner recorded in the database
• Unexpected modifications to pending code changes in conversations that the owning user did not initiate
• High-volume enumeration of conversation IDs from a single authenticated session

Detection Strategies

• Correlate application access logs with the conversations table to flag sync calls whose caller is not the conversation owner
• Alert on the same user account submitting code-changes/sync requests against many distinct conversation_id values in a short window
• Compare pending code-change diffs against the originating conversation's message history for logical inconsistencies

Monitoring Recommendations

• Ingest potpie API access logs and database audit events into a centralized analytics platform for longitudinal review
• Track baselines of sync request volume per user and alert on statistical outliers
• Enable database-level change data capture on the pending-changes table to preserve tamper evidence

How to Mitigate CVE-2026-85669

Immediate Actions Required

• Restrict access to potpie instances to trusted, authenticated users until a patched release is deployed
• Review recent code-changes/sync activity for requests where the caller does not own the target conversation, and revert tampered pending changes
• Rotate API tokens for accounts observed enumerating conversation IDs

Patch Information

At the time of publication, potpie versions through 2.0.0 are affected. Monitor the GitHub Repository for PotPie and GitHub Issue #870 Discussion for a fixed release that adds an ownership check to the code-changes/sync handler. Upgrade to the patched version once available and redeploy affected instances.

Workarounds

• Apply a reverse-proxy or API gateway rule that rejects POST /conversations/{conversation_id}/code-changes/sync requests unless the caller's session maps to the owning user
• Patch the conversations_router.py handler locally to invoke the existing conversation ownership validation before writing pending changes
• Limit potpie to single-tenant deployments where all authenticated users are trusted to view and modify each other's conversations

# Example nginx rule blocking the vulnerable endpoint until patched
location ~ ^/conversations/[^/]+/code-changes/sync$ {
    if ($request_method = POST) { return 403; }
    proxy_pass http://potpie_upstream;
}