CVE-2026-121558

AuditPilot trusts a caller-supplied project in knowledge searches

Ricky-7-Yan · AuditPilot agentic retrieval

First documented disclosure · Review checkpoint

Summary

A user with knowledge-read permission on one project can request chunks from another project in the same tenant.

Severity and exploitation evidence

Low · 2.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Static source analysis only. The researcher did not send requests to a running deployment.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The query and research-answer paths accept a project ID in request context. Retrieval checks that supplied ID without checking the user’s membership in the project.

Conditions required

An enforced, shared deployment with at least two projects in one tenant, an authenticated reader and the target project ID.

Potential impact

Retrieved text from the other project can enter raw search results or an AI answer. The tenant check still applies.

Affected versions and configurations

Git revisions before 4669c93. The researcher reviewed e4f1bf1 on the project’s development branch.

Fix and mitigation status

Maintainer commit 4669c93f3a7403a0e242bef14d771beef0b4356b fixes the project authorization check.

Practical next steps

Deploy a revision containing the patch. Test both retrieval endpoints with an account limited to a different project.

Operating lesson

Build retrieval filters from the authenticated user’s authorized projects before using IDs in a prompt or request.

Evidence and limits

The researcher linked the finding publicly October 22. The fix landed November 2 and the CNA record followed November 3. The default local desktop mode does not provide the shared project boundary described here.

Sources