CVE-2026-77240

Summary

Authenticated users can modify their own account_role and account_id, and an authenticated non-member can read another tenant's knowledge-base chunks, potentially leading to unauthorized access and data modification.

Exploitability

Exploitation is relatively straightforward for authenticated users and requires an authenticated non-member with access to the affected migration scripts.

Blast radius

If exploited, this could result in unauthorized access to tenant resources and data, compromising the integrity and confidentiality of the system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.7.1 or later, which includes the necessary fixes for these vulnerabilities.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.