CVE-2026-82290CWE-639

CVE-2026-82290

Medium · published August 29, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
26.2
In the wild
Unconfirmed
What it is

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00340 · 26.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-08-29T00:20Z
References (5)
https://github.com/Chainlit/chainlit · [email protected]https://github.com/Chainlit/chainlit/blob/190ea74239d9e84b26e7c91bc2882dd038942564/backend/chainlit/server.py · [email protected]https://github.com/Chainlit/chainlit/issues/2975 · [email protected]https://www.vulncheck.com/advisories/chainlit-feedback-endpoints-missing-ownership-validation · [email protected]https://github.com/Chainlit/chainlit/issues/2975 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:19Z
    Chainlit Feedback Endpoints Missing Ownership Validation
    cvelistv5