MaxKB versions 2.0.0 through 2.10.2-lts contain an authorization bypass vulnerability (CWE-639, CWE-862) where the API endpoints for documents and paragraphs authorize based solely on the knowledge_id in the request path. However, when querying the target Document or Paragraph by their respective IDs, the system does not confirm that these objects belong to the authorized knowledge base. Consequently, a normal workspace user who knows a victim's document or paragraph UUID can exploit this flaw by using an attacker-owned knowledge base path to access or modify another user's knowledge base content. This vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity. No patches or fixed versions are currently available.

An attacker with normal workspace user privileges can read or modify documents or paragraphs in another user's knowledge base if they know the UUID of the target document or paragraph. This leads to unauthorized disclosure and modification of content across knowledge bases within the MaxKB environment. There is no indication of availability impact or known active exploitation in the wild.

No official fix or patch is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict access to knowledge base UUIDs and limit sharing of document or paragraph identifiers to trusted users only to reduce the risk of exploitation.