CVE-2026-82290

Received Received - Intake

Chainlit Feedback Ownership Validation Bypass

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82290

EUVD

EUVD-2026-67821

Affected Vendors & Products

Vendor	Product	Version / Range
chainlit	chainlit	to 2.12.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

CVE-2026-82290 is an authorization bypass vulnerability in Chainlit versions up to 2.12.0. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers without ownership validation. This corrupts human-rating data used for model evaluation.

Detection Guidance

To detect this vulnerability, monitor HTTP requests to the /feedback endpoints (PUT and DELETE) for unauthorized modifications or deletions of feedback records. Check logs for requests with arbitrary feedback IDs from non-owning users. Use tools like curl to test endpoints: curl -X PUT http://<target>/feedback/<arbitrary_id> -H 'Authorization: Bearer <token>' to see if unauthorized changes are allowed.

Impact Analysis

Attackers with valid accounts can silently delete or falsify feedback across all users. This corrupts training data, manipulates ratings, and undermines model evaluation processes in multi-user deployments.

Mitigation Strategies

Immediately update Chainlit to the latest version beyond 2.12.0. Implement strict ownership validation for feedback endpoints by checking user IDs against feedback records. Restrict DELETE and PUT operations to authenticated users with proper authorization. Review logs for suspicious activity and revoke any unauthorized feedback changes.

Hi! I’m here to help you understand CVE-2026-82290. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70