Executive brief
MaxKB is an open-source AI assistant platform that allows users to have conversations with a chatbot. An attacker with any valid chat token can create a public, unauthenticated share link for another user's conversation without permission, exposing all messages and uploaded files publicly and permanently. Even the victim cannot revoke access because no delete mechanism exists in the current code.
Technical details
The POST /chat/api/{application_id}/chat/{chat_id}/share_chat endpoint verifies a conversation exists but fails to check whether the caller owns it (chat_user_id mismatch) or whether their application token matches the chat's application. An attacker obtaining a free anonymous chat token for any published application can supply a known victim's chat_id to mint a public ChatShareLink and PublicFileAccess rows; GET /chat/api/share/{link} and /chat/oss/file/{id} retrieve content without authentication. The vulnerability requires the attacker to already know the target chat_id (a UUIDv7 not exposed in UI), but no revoke path exists to undo exposure.
Affected products
- 1Panel MaxKB 2.7.0 through 2.10.4-lts
Timeline
- 2026-09-21: disclosed: Published on NVD and GitHub Security Advisory GHSA-m8gr-554p-8r82
- 2026-02: other: Share feature introduced in MaxKB