CVE-2026-77517Medium· 5.4▾ TwilightPoC availableMaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path, then query the target Document by document_id or Paragraph…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 22.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
Exploit / PoC code exists
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path, then query the target Document by document_id or Paragraph by paragraph_id without confirming that the object belongs to that knowledge base. A normal workspace user with a known victim document or paragraph UUID can use an attacker-owned knowledge-base path to read or modify content in another user's knowledge base. No fixed version is available as of this review.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77516Medium· 5.4MaxKB is an open-source AI assistant for enterprise
CVE-2026-77518Medium· 5.0MaxKB is an open-source AI assistant for enterprise
CVE-2026-77520Medium· 5.4MaxKB is an open-source AI assistant for enterprise
CVE-2026-77525Medium· 4.2MaxKB is an open-source AI assistant for enterprise
CVE-2026-77523High· 7.4MaxKB is an open-source AI assistant for enterprise
CVE-2026-79917Medium· 6.5MaxKB is an open-source AI assistant for enterprise