CVE-2026-77523

Summary

The flaw allows an authenticated user to read or overwrite another user's model parameters in MaxKB AI assistant, potentially altering default settings. This matters because it can lead to unauthorized changes affecting workflows.

Exploitability

Exploitation requires authentication and model read permission within a specific workspace; moderate effort needed.

Blast radius

If exploited, the impact could be significant as it affects multiple workspaces and their associated models, potentially disrupting enterprise operations.

Prioritized remediation

Restrict model parameter access to include workspace_id in queries to prevent unauthorized reads or overwrites.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.