CVE-2026-85093
Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the collection using the offset cursor.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the collection using the offset cursor.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.32% probability · 25th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-863
- Source
- disclosure@vulncheck.com
References
- https://github.com/cheshire-cat-ai/core
- https://github.com/cheshire-cat-ai/core/blob/1.9.2/core/cat/looking_glass/stray_cat.py
- https://github.com/cheshire-cat-ai/core/blob/1.9.2/core/cat/routes/memory/points.py#L350
- https://github.com/cheshire-cat-ai/core/issues/1136
- https://www.vulncheck.com/advisories/cheshire-cat-ai-memory-collection-endpoint-information-disclosure
- https://github.com/cheshire-cat-ai/core/issues/1136
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.