CVE-2026-85669CWE-862broken-access-control

CVE-2026-85669

Medium · published September 4, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
31.7
In the wild
Unconfirmed
What it is

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending changes.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00389 · 31.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-04T19:17Z
References (4)
https://github.com/potpie-ai/potpie · [email protected]https://github.com/potpie-ai/potpie/blob/v2.0.0/legacy/app/modules/conversations/conversations_router.py · [email protected]https://github.com/potpie-ai/potpie/issues/870 · [email protected]https://www.vulncheck.com/advisories/potpie-through-2.0.0-missing-ownership-check-via-code-changes-sync · [email protected]
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 14:32Z
    potpie through 2.0.0 Missing Ownership Check via code-changes sync
    cvelistv5