This vulnerability affects the file management API endpoints in the chatchat-space Langchain-Chatchat project, specifically the functions files/list_files/retrieve_file/retrieve_file_content/delete_file within libs/chatchat-server/chatchat/server/api_server/openai_routes.py. Due to missing authentication controls, an attacker with local network access can potentially interact with these functions without proper authorization. The issue was responsibly disclosed but remains unaddressed by the vendor. The CVSS 4.0 base score is 5.3, reflecting medium severity with attack vector limited to adjacent network and low complexity.

An attacker on the local network can exploit this vulnerability to access or manipulate files via the affected API functions without authentication. This could lead to unauthorized file retrieval or deletion within the Compatible File Service component. The impact is limited by the requirement for local network access and the absence of privilege or user interaction requirements. There is no indication of remote exploitation or privilege escalation beyond the missing authentication on these endpoints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should restrict network access to the affected service to trusted hosts only, especially limiting local network exposure. Monitoring and network segmentation may help reduce risk until an official patch is released.