No access to your tenant or devices. Every item links to its source. What this means
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path, then query the target Document by document_id or Paragraph by paragraph_id without confirming that the object belongs to that knowledge base. A normal workspace user with a known victim document or paragraph UUID can use an attacker-owned knowledge-base path to read or modify content in another user's knowledge base. No fixed version is available as of this review.
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "1Panel-dev",
"product": "MaxKB",
"versions": [
{
"version": ">= 2.0.0, <= 2.10.2-lts",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON