CVE-2026-79917

Name of the Vulnerable Software and Affected Versions MaxKB versions 2.7.0 through 2.10.4-lts

Description An issue exists where the system verifies the existence of a conversation but fails to confirm if it belongs to the authenticated chat user id or the application associated with the caller's token. An attacker possessing any valid chat token and a known victim chat id can utilize the POST '/chat/api/{application id}/chat/{chat id}/share chat' endpoint to create an unauthenticated public ChatShareLink. This action exposes the victim's conversation and creates a PublicFileAccess state, allowing associated files to be retrieved without credentials. There is currently no available path to revoke this access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the POST '/chat/api/{application id}/chat/{chat id}/share chat' endpoint.