{"id":"CVE-2026-77516","published":"2026-09-21T21:17:10.143","lastModified":"2026-09-21T21:17:10.280","description":"MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through tool_ids, skill_tool_ids, or mcp_tool_ids and execute it through the agent or workflow dispatch path. The dispatch path does not reapply the per-tool grant enforced by dedicated tool routes, and tool execution decrypts server-side init_params, allowing the caller to receive credentials carried by the denied tool. No fixed version is available as of this review.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-639","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-383v-fx78-pphm","tags":[]}],"exploitRefs":[{"url":"https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-383v-fx78-pphm","tags":[]}],"hasPoc":true,"ai":{"summary":"Users with a low role can still execute tools they are denied access to by binding identifiers through various paths, leading to potential credential exposure.","exploitability":"Exploitation requires knowledge of the tool IDs and permission structure; preconditions include having a low-role workspace member account.","blast_radius":"If exploited, this flaw could lead to unauthorized execution of tools and potential credential theft within the enterprise environment.","remediation":"Restrict tool execution paths to enforce per-tool grants and ensure that dispatch paths reapply these grants.","tags":["rce","auth-bypass","web","api"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:26:18.729Z"}}