CVE-2026-75480CWE-863broken-access-control

CVE-2026-75480

Medium · published August 18, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
34.7
In the wild
Unconfirmed
What it is

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can query these endpoints to retrieve private memories, resources, skills, and secret material belonging to other users in the same account without administrative privileges.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00415 · 34.7th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-18T01:16Z
References (4)
https://github.com/volcengine/OpenViking · [email protected]https://github.com/volcengine/OpenViking/blob/main/openviking/storage/viking_vector_index_backend.py · [email protected]https://github.com/volcengine/OpenViking/issues/3724 · [email protected]https://www.vulncheck.com/advisories/openviking-debug-vector-endpoints-multi-tenant-data-exposure · [email protected]
EPSS history
Timeline
  • 17 AUG 20:36Z
    OpenViking Debug Vector Endpoints Multi-tenant Data Exposure
    cvelistv5