CVE-2026-79917 is an improper authorization vulnerability (CWE-285) in 1Panel-dev's MaxKB open-source AI assistant for enterprise. In affected versions 2.7.0 through 2.10.4-lts, the POST /chat/api/{application_id}/chat/{chat_id}/share_chat endpoint only verifies the existence of a conversation but fails to verify ownership by the authenticated chat_user_id or the application bound to the caller's token. This flaw enables an attacker possessing any chat token and a known victim chat_id to generate an unauthenticated public ChatShareLink, exposing the victim's conversation. Additionally, the attacker can create a PublicFileAccess state that allows retrieval of associated files without credentials. There is no available patch or fix at the time of this analysis.

An attacker can expose private conversations and associated files of other users without proper authorization, leading to a confidentiality breach. The vulnerability allows unauthorized creation of public share links and file access states with no available revocation mechanism, increasing the risk of persistent data exposure. The CVSS 3.1 base score is 6.5 (medium severity), reflecting high confidentiality impact but low integrity and no availability impact.

No official fix or patch is currently available for this vulnerability. Users should restrict access to chat tokens and monitor usage closely. Since there is no revoke path for created public share links or file access states, affected deployments should consider disabling or restricting the vulnerable API endpoint until a fix is released. Check the vendor's advisory or repository for updates on remediation status.