CVE-2026-85093

Name of the Vulnerable Software and Affected Versions Cheshire Cat AI (affected versions not specified)

Description The 'GET /memory/collections/{collection id}/points' endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve stored conversation messages and personal data belonging to all users by paginating through the collection using the offset cursor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.