CVE-2026-79917

Deferred Deferred - Pending Action

Unauthenticated Chat Share Exposure in MaxKB

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a conversation exists but does not verify that it belongs to the authenticated chat_user_id or to the application bound to the caller's token. An attacker with any chat token and a known victim chat_id can create an unauthenticated public ChatShareLink exposing the victim's conversation and can create PublicFileAccess state that makes associated files retrievable without credentials, with no available revoke path. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-21

Last Modified

2026-09-21

Generated

2026-09-22

AI Q&A

2026-09-22

EPSS Evaluated

N/A

NVD

CVE-2026-79917

Affected Vendors & Products

Vendor	Product	Version / Range
maxkb	maxkb	From 2.7.0 (inc) to 2.10.4-lts (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

MaxKB versions 2.7.0 through 2.10.4-lts have an issue where sharing a chat does not verify ownership. An attacker with any chat token and a known victim chat ID can create an unauthenticated public link exposing the victim's conversation. This also creates a public file access state, allowing files to be retrieved without credentials, with no way to revoke access.

Impact Analysis

If exploited, this vulnerability could expose sensitive conversations and associated files to unauthorized users. Attackers could access private data without authentication, leading to data breaches, loss of confidentiality, and potential misuse of shared information.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for data protection and access controls. It could result in unauthorized data exposure, leading to regulatory penalties, loss of trust, and legal consequences due to non-compliance with privacy and security standards.

Mitigation Strategies

Upgrade MaxKB to a version beyond 2.10.4-lts if available. If no fixed version exists, restrict access to the vulnerable endpoint POST /chat/api/{application_id}/chat/{chat_id}/share_chat by implementing proper authentication and authorization checks. Review and revoke any unauthorized ChatShareLinks or PublicFileAccess states created due to this issue.

Hi! I’m here to help you understand CVE-2026-79917. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70