Threats tagged 'ghsa-7pf8-cp62-gc3p'

CVE-2026-111702 is an authorization bypass vulnerability in sugarforever's chat-ollama product, present through commit 96c3ce5. It allows remote attackers to access other users' private knowledge bases by supplying sequential IDs in API requests. Attackers can enumerate these IDs via GET /api/knowledgebases/{id} or the knowledgebaseId parameter in POST /api/models/chat, enabling them to read metadata and document content without authorization. The vulnerability has a high severity with a CVSS score of 8.7.