---
id: CVE-2026-85693
title: >-
  Chatbot UI contains an authorization bypass vulnerability in the retrieval
  endpoint that allows authenticated attackers to access private file content
  belonging to other users by supplying arbitrary file UUIDs
summary: >-
  Chatbot UI contains an authorization bypass vulnerability in the retrieval
  endpoint that allows authenticated attackers to access private file content
  belonging to other users by supplying arbitrary file UUIDs. The endpoint uses
  a servic…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-639
vendor: mckaywrigley
product: chatbot-ui
affected:
  - chatbot-ui <= 81328b61d2a4ab597a7a057be70e785cf756d9f8
published: '2026-09-04'
updated: '2026-09-14'
sourceUpdated: '2026-09-14T20:16:59.810'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85693'
references:
  - url: 'https://github.com/mckaywrigley/chatbot-ui'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mckaywrigley/chatbot-ui/blob/81328b61d2a4ab597a7a057be70e785cf756d9f8/app/api/retrieval/retrieve/route.ts
    label: disclosure@vulncheck.com
  - url: 'https://github.com/mckaywrigley/chatbot-ui/issues/2028'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/chatbot-ui-cross-user-private-file-content-disclosure-via-retrieval-api
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.0025
epssPercentile: 0.16721
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-14T19:20:56.218533Z'
ingestedAt: '2026-09-14T20:14:21.166Z'
---

## Overview

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and fails to validate file ownership, enabling attackers to retrieve indexed content chunks from victim files through crafted POST requests.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.