VulnerabilityReceived
CVE-2026-82290
Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.
MEDIUM 6.0EPSS 0.21%
Does this matter?
Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.
Description
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.
- CVSS 4.0
- 6.0 MEDIUMCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.21% probability · 11th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Source
- disclosure@vulncheck.com
References
- https://github.com/Chainlit/chainlit
- https://github.com/Chainlit/chainlit/blob/190ea74239d9e84b26e7c91bc2882dd038942564/backend/chainlit/server.py
- https://github.com/Chainlit/chainlit/issues/2975
- https://www.vulncheck.com/advisories/chainlit-feedback-endpoints-missing-ownership-validation
- https://github.com/Chainlit/chainlit/issues/2975
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.