CVE-2026-85669: Missing Authorization in potpie-ai potpie

The potpie application up to version 2.0.0 contains an authorization bypass vulnerability on the POST /conversations/{conversation_id}/code-changes/sync endpoint. The system does not verify that the authenticated user owns the conversation they are attempting to modify. As a result, an attacker with valid authentication can supply arbitrary conversation IDs belonging to other users and write unauthorized file changes into those conversations.

An attacker with authenticated access can modify pending code changes in conversations they do not own, potentially leading to unauthorized code injection or alteration. This compromises the integrity of user data and may affect application functionality or security depending on the nature of the code changes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users and monitor for suspicious activity involving conversation ID manipulation.