CVE-2026-82290 in Chainlit
Summary
by MITRE • 08/28/2026
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Chainlit versions up to 2.12.0 represents a critical failure in access control mechanisms, specifically categorized under CWE-639: Authorization Bypass Through User-Controlled Key. This flaw arises from the application's inability to properly validate that the authenticated user initiating a request possesses ownership or administrative rights over the specific feedback record targeted for modification or deletion. In secure software architecture, any operation affecting shared resources must enforce strict identity verification against resource ownership before executing state-changing actions. The absence of this validation in the PUT and DELETE endpoints allows an attacker who has successfully authenticated to interact with arbitrary data objects within the system database.
From a technical perspective, the exploitation vector relies on manipulating the unique identifier associated with feedback records during HTTP requests. When an authenticated user sends a request to delete or update a feedback entry, the backend processes the action based solely on the provided identifier without cross-referencing it against the identity of the session owner. This lack of server-side authorization checks means that by simply altering the ID parameter in the API call, an attacker can target records belonging to other users. The vulnerability is particularly severe because it affects both modification and destruction operations, allowing for comprehensive data tampering rather than just read-only access violations.
The operational impact of this vulnerability extends beyond simple data corruption; it directly undermines the integrity of machine learning model evaluation processes that rely on human feedback ratings. Chainlit applications are frequently used to build chat-based interfaces where user interactions generate valuable training or tuning data through explicit feedback mechanisms such as thumbs up, thumbs down, or textual comments. If an attacker can arbitrarily delete or alter these records, they can skew the quality metrics of the model being evaluated. This could lead to degraded performance in production environments if the compromised data is used for fine-tuning, effectively introducing a supply chain attack vector where malicious actors poison the learning dataset by injecting false signals or removing critical positive feedback.
This type of vulnerability aligns with several entries in the MITRE ATT&CK framework, most notably T1078: Valid Accounts and T1562: Impair Defenses through Disabling Security Tools or Processes, although more accurately it maps to data manipulation tactics such as T1499: Endpoint Denial of Service via resource exhaustion or corruption. In the context of web application security frameworks like OWASP Top 10, this falls squarely under Broken Access Control, which remains one of the most prevalent and dangerous categories of vulnerabilities in modern applications. The ability to act on behalf of other users without their consent violates the fundamental principle of least privilege and fails to enforce proper object-level permissions.
To mitigate this vulnerability, developers must implement robust server-side authorization checks for all endpoints that modify or delete user-generated content. This involves ensuring that every PUT and DELETE request includes a verification step where the system compares the authenticated user's identity against the owner field of the target feedback record. If they do not match, the request should be rejected with an appropriate HTTP 403 Forbidden status code rather than proceeding with the operation. Additionally, implementing rate limiting on these endpoints can help mitigate brute-force attempts to guess valid identifiers, although this is a secondary defense and does not replace proper access control logic. Upgrading to patched versions of Chainlit that address this authorization bypass is essential for maintaining data integrity in AI-driven applications.