CVE-2026-85693: Chatbot UI Authorization Bypass Vulnerability

CVE-2026-85693 Overview

CVE-2026-85693 is an authorization bypass vulnerability in Chatbot UI, an open-source conversational AI interface maintained on GitHub. The flaw resides in the retrieval endpoint at app/api/retrieval/retrieve/route.ts. An authenticated attacker can submit crafted POST requests containing arbitrary file UUIDs and retrieve indexed content chunks from files owned by other users. The endpoint uses a service-role Supabase client that bypasses row-level security (RLS) and omits any ownership check on the requested file. The weakness maps to CWE-639: Authorization Bypass Through User-Controlled Key and enables cross-tenant disclosure of private document content.

Critical Impact
Any authenticated Chatbot UI user can read private file content belonging to any other user by guessing or obtaining file UUIDs, breaking tenant isolation for uploaded documents.

Affected Products

Chatbot UI (mckaywrigley/chatbot-ui) retrieval API route at commit 81328b61d2a4ab597a7a057be70e785cf756d9f8
Chatbot UI deployments that back retrieval with a service-role Supabase client
Self-hosted forks reusing the vulnerable retrieve/route.ts handler

Discovery Timeline

2026-09-04 - CVE-2026-85693 published to the National Vulnerability Database
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85693

Vulnerability Analysis

Chatbot UI stores uploaded documents in Supabase and indexes their content as chunks for retrieval-augmented generation. The retrieval endpoint accepts a list of file identifiers in the POST body and returns matching content chunks. The handler instantiates a Supabase client using the service-role key rather than the caller's user-scoped session. Service-role clients bypass Postgres row-level security by design. Because the handler never verifies that the authenticated user owns the requested file_id values, it returns chunks for any UUID supplied. An attacker with a valid Chatbot UI account and any known or discovered file UUID can therefore harvest private content across tenants.

Root Cause

The root cause is missing object-level authorization on a server-side endpoint that trusts a client-supplied identifier. Two design choices combine to produce the bypass: use of the service-role Supabase key inside a user-facing route, and the absence of an explicit WHERE user_id = auth.uid() check before returning file chunks. This pattern is characteristic of [CWE-639] and Broken Object Level Authorization in the OWASP API Security Top 10.

Attack Vector

Exploitation requires network access to the application and a low-privileged authenticated session. An attacker sends a POST request to the retrieval route containing arbitrary file UUIDs in the payload. The server responds with indexed chunks belonging to the target files, regardless of ownership. UUIDs can be obtained through shared links, referrer leakage, log exposure, or enumeration where identifiers are exposed elsewhere in the application. No user interaction from the victim is required, and the exploit only reveals data — it does not modify or destroy files. See the VulnCheck advisory and the vulnerable route source for technical details.

Detection Methods for CVE-2026-85693

Indicators of Compromise

POST requests to /api/retrieval/retrieve from a single authenticated session referencing file UUIDs not previously associated with that user's uploads.
Spikes in retrieval endpoint volume or unusually large fileIds arrays in request bodies.
Supabase audit or Postgres logs showing service-role queries against file_items for user IDs that differ from the authenticated caller.

Detection Strategies

Correlate authenticated session identity with the user_id column of files referenced in retrieval requests and alert on mismatches.
Instrument the retrieval route to log requester user_id, requested file_id, and file owner, then baseline normal access patterns.
Deploy application-layer rules that flag POST bodies containing more than a small number of distinct file UUIDs per request.

Monitoring Recommendations

Enable Supabase database logs and forward them to a centralized log store for retention and search.
Monitor for enumeration-style behavior against any endpoint that accepts UUIDs from clients.
Alert on authenticated accounts that touch retrieval APIs at rates significantly above the user baseline.

How to Mitigate CVE-2026-85693

Immediate Actions Required

Inventory Chatbot UI deployments and identify any forks that expose app/api/retrieval/retrieve/route.ts in its vulnerable form.
Restrict access to the Chatbot UI instance to trusted users while a fix is applied, and rotate the Supabase service-role key if exposure is suspected.
Review Supabase logs for cross-user retrieval patterns going back to the deployment date.

Patch Information

No vendor-issued patch release is referenced in the NVD entry at the time of publication. Track remediation progress in the upstream Chatbot UI issue tracker and the Chatbot UI repository. Operators of self-hosted deployments should modify retrieve/route.ts to use a user-scoped Supabase client and add an explicit ownership check that filters file_items by the authenticated user_id before returning chunks.

Workarounds

Replace the service-role Supabase client in the retrieval route with a request-scoped client that respects row-level security.
Add a server-side ownership check that verifies each requested file_id belongs to the authenticated user before querying chunks.
Enable and enforce row-level security policies on files and file_items tables so that even a misused service-role query surfaces during review.
Place the application behind an authenticated reverse proxy or SSO gateway to limit which accounts can reach the retrieval API.

bash

# Configuration example
# Refer to the VulnCheck advisory and upstream issue for remediation guidance:
# https://www.vulncheck.com/advisories/chatbot-ui-cross-user-private-file-content-disclosure-via-retrieval-api
# https://github.com/mckaywrigley/chatbot-ui/issues/2028