CVE-2026-75480

Received Received - Intake

OpenViking Debug Endpoints Expose Co-Tenant Data

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-75480

EUVD

EUVD-2026-60392

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenViking allows authenticated users to access debug vector scroll and count endpoints that lack user-level access controls. These endpoints enforce only account-level scoping, enabling attackers to read private data such as memories, resources, skills, and secret material belonging to other users within the same account without needing administrative privileges.

Impact Analysis

If you use OpenViking, attackers could exploit this flaw to access sensitive information belonging to other users in your account. This could lead to data breaches, unauthorized access to personal or confidential data, and potential misuse of resources or skills without your knowledge.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties, fines, and reputational damage.

Mitigation Strategies

Implement user-level access controls for the OpenViking debug vector scroll and count endpoints to restrict data access to authorized users only. Review and update existing account-level scoping to enforce stricter isolation between co-tenant records.

Hi! I’m here to help you understand CVE-2026-75480. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70