Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. (CVE-2026-82290)

The vulnerability identified as CVE-2026-82290 affects Chainlit through version 2.12.0. It is caused by improper validation of ownership for feedback records in the PUT and DELETE API endpoints. Authenticated attackers with low privileges can exploit this flaw to delete or modify feedback submitted by other users by providing arbitrary feedback record identifiers. This compromises the integrity of human-rating data, which is critical for evaluating model performance. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The CVSS v3.1 base score is 5.3, indicating a moderate severity with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

An attacker who is authenticated with low privileges can delete or modify feedback records submitted by other users. This compromises the integrity of the human-rating data used for model evaluation, potentially corrupting the evaluation results. There is no impact on confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the PUT and DELETE feedback endpoints to trusted users only, and monitor for suspicious activity related to feedback record modifications. Implement additional access control checks to ensure ownership validation before modifying or deleting feedback records.