What happened
Published Sept 3, 2026 (CVSS 6.5), this is a broken access-control / IDOR-style flaw in Cheshire Cat AI's conversational-memory retrieval API.
Why it matters
Cheshire Cat AI is an open-source conversational AI framework with persistent long-term memory; a missing tenant-isolation check on the memory-retrieval endpoint means any low-privilege authenticated user can mass-harvest every other user's private conversation history — a direct privacy and data-exposure failure in an LLM memory subsystem.
Attack vector
The GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. An authenticated attacker holding only MEMORY:READ permission can paginate through the collection to retrieve all users' stored conversation messages and personal data, not just their own.
Affected systems
Cheshire Cat AI core (GET /memory/collections/{collection_id}/points endpoint)
Mitigation
Apply vendor fix (see cheshire-cat-ai/core GitHub repository for patched release).