CVE-2026-77517

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.0.0 through 2.10.2-lts

Description An authorization flaw exists in the document and paragraph operation routes. The system validates the knowledge id in the request path but fails to verify if the target Document, identified by document id, or Paragraph, identified by paragraph id, actually belongs to that specific knowledge base. This allows a workspace user who possesses a victim's document or paragraph UUID to use a knowledge base they own to read or modify content belonging to another user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.