PT-2026-117955 · Letta-Ai · Letta
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user id HTTP header. Attackers can set user id to another tenant's ID, even with LETTA SERVER SECURE enabled, to read and modify that user's agents, memory and configuration.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Letta