What happened
Published 2026-09-21 as a batch of GitHub advisories in MaxKB. Collectively they show authorization is enforced on the request path parameter but not consistently on the underlying global object IDs, so workspace tenancy and per-resource permissions are bypassable.
Why it matters
MaxKB hosts enterprise knowledge bases and agent tooling; these gaps let a low-privileged workspace user read/steer another user's or workspace's AI application state (retrieval data, RAG documents, chat history, model config) — the precise data an attacker would target in a multi-tenant assistant deployment.
Attack vector
Authorisation gaps where routes authorise a path-level resource (workspace_id, knowledge_id, application_id) but load objects by global id without ownership checks: denied users can bind and invoke tools via tool_ids (77516), read/modify other workspaces' documents/paragraphs (77517), read hidden MCP tools (77518), reuse expired non-permanent application keys on the MCP endpoint (77519, no fix yet), read other users' application_id via ranking endpoint (77520), crawl web docs with TLS verification off and no scheme/loopback restrictions (77522), modify models by id-only (77523), read chat records by global chat_id (77525), and access conversations on other applications via share_chat (79917).
Affected systems
MaxKB (1Panel-dev) various ranges through 2.10.3-lts (CVE-2026-77516/77517/77518/77519/77520/77522/77523/77525/79917)
Mitigation
Upgrade to fixed LTS releases per advisory; CVE-2026-77519 has no fixed release yet — restrict the /chat/api/mcp endpoint until patched.