CVE-2026-121558 is an authorization bypass vulnerability in the Ricky-7-Yan intelligent-audit-system (AuditPilot) before commit 4669c93. It allows authenticated users with read:knowledge permission scoped to one project to access knowledge from other projects by manipulating the project_id parameter in certain API endpoints. This vulnerability affects version 0 of the product and has a low severity rating with a CVSS score of 2.3.