What happened
AuditPilot's agentic RAG path validates the requesting user's project scope only against the authenticated project, but _metadata_allowed does not enforce the caller's trusted project_id when one is supplied, allowing cross-project knowledge reads in the same tenant. CVSS 4.3 (3.1) / 2.3 (4.0), published 2026-11-03.
Why it matters
This is an agentic RAG retrieval tool that feeds an LLM. An authorization bypass in the knowledge-retrieval surface leaks one project's retrieved documents to an authenticated user of another project — a cross-project data-disclosure flaw in an AI audit/RAG system, with low severity and narrow reach.
Attack vector
Authorization bypass (CWE-639, improper authorization) in _metadata_allowed in rag/agentic_rag.py. An authenticated user with read:knowledge on one project supplies a different project_id via GET /api/knowledge/query or POST /api/research/answer to read other projects' knowledge chunks within the same tenant.
Affected systems
intelligent-audit-system (AuditPilot) before commit 4669c93 (rag/agentic_rag.py _metadata_allowed / web/main.py)
Mitigation
Upgrade the repo to commit 4669c93f3a7403a0e242bef14d771beef0b4356b (or later). Reference: https://github.com/Ricky-7-Yan/intelligent-audit-system/issues/7