CVE-2026-85693

Name of the Vulnerable Software and Affected Versions Chatbot UI (affected versions not specified)

Description An authorization bypass exists in the retrieval endpoint. Authenticated attackers can access private file content of other users by providing arbitrary file UUIDs. The issue occurs because the endpoint utilizes a service-role Supabase client that bypasses row-level security (a security feature that restricts which rows of data a user can access) and fails to validate file ownership. This allows the retrieval of indexed content chunks from victim files via crafted POST requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.