This vulnerability affects serge-chat serge up to version 1.4TB, specifically the download_model and delete_model functions in the api/src/serge/routers/model.py file of the Model API Endpoint component. Due to missing authentication controls, an attacker can remotely invoke these functions without credentials, potentially leading to unauthorized access or deletion of models. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity) with network attack vector, no privileges required, no user interaction, and low impact on confidentiality and availability. The exploit has been publicly disclosed, but the vendor has not issued any patch or mitigation.

An attacker can remotely access and manipulate the download_model and delete_model API functions without authentication, potentially leading to unauthorized data access or deletion within the affected serge-chat serge instance. The impact is rated medium severity based on CVSS 4.0 scoring. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing compensating controls such as restricting network access to the affected API endpoints or deploying web application firewalls to limit unauthorized access until a patch is released.