MaxKB, an open-source AI assistant for enterprise, suffers from a missing authorization vulnerability (CWE-862) in versions 2.10.2-lts and earlier. A normal user can retrieve another user's application_id from the homepage application question-ranking endpoint when the victim's application has ranking activity in the selected date range and the attacker knows or guesses the application name. Although direct application detail and debug-open routes deny access, the disclosed identifier can be embedded in an attacker-owned workflow application node. Triggering this workflow causes output generation by the victim application and creates durable application_chat and application_chat_record entries under the victim's application. This occurs because save and runtime paths do not verify permissions to use the referenced application. No patched version is available as of the review date.

An attacker with normal user privileges in the same workspace can access another user's application_id and leverage it to execute workflows that generate outputs and create persistent chat records under the victim's application. This unauthorized use of the victim's application context can lead to information disclosure and potential misuse of application resources. The vulnerability has a CVSS 3.1 score of 5.4 (medium severity), indicating limited confidentiality and integrity impact without availability impact.

No official fix or patch is currently available for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is released, restrict user permissions to limit the ability to create and publish workflow applications, and consider isolating sensitive applications or workspaces to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.