Quick answers
- Is CVE-2026-79917 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-79917 being exploited in the wild.
- How severe is CVE-2026-79917?
- Medium severity, with a CVSS score of 6.5, published 21 September 2026.
- Which products and versions are affected?
- 1Panel MaxKB 2.7.0 through 2.10.4-lts.
- Is there a fix for CVE-2026-79917?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-79917 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-79917?
- Check whether you run 1Panel MaxKB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The POST /chat/api/{application_id}/chat/{chat_id}/share_chat endpoint verifies a conversation exists but fails to check whether the caller owns it (chat_user_id mismatch) or whether their application token matches the chat's application. An attacker obtaining a free anonymous chat token for any published application can supply a known victim's chat_id to mint a public ChatShareLink and PublicFileAccess rows; GET /chat/api/share/{link} and /chat/oss/file/{id} retrieve content without authentication. The vulnerability requires the attacker to already know the target chat_id (a UUIDv7 not exposed in UI), but no revoke path exists to undo exposure.
Affected products
- 1Panel MaxKB 2.7.0 through 2.10.4-lts
Timeline
- 2026-09-21: disclosed: Published on NVD and GitHub Security Advisory GHSA-m8gr-554p-8r82
- 2026-02: other: Share feature introduced in MaxKB