CVE-2026-111702: Authorization Bypass Through User-Controlled Key in sugarforever chat-ollama

The vulnerability in chat-ollama (up to commit 96c3ce5) is an insecure direct object reference (IDOR) that permits attackers to bypass authorization controls by supplying sequential knowledgebase IDs. Attackers can enumerate these IDs through GET requests to /api/knowledgebases/{id} or by manipulating the knowledgebaseId parameter in POST requests to /api/models/chat. This flaw allows unauthorized access to private knowledge bases, exposing metadata and document content belonging to other users.

Exploitation of this vulnerability enables remote attackers to access private knowledge bases of other users without any authentication or privileges. This leads to unauthorized disclosure of sensitive metadata and document content, potentially compromising user privacy and confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints and monitor for suspicious enumeration activity. Implement proper authorization checks on knowledgebase ID parameters to prevent unauthorized access.