CVE-2026-77523
MaxKB: Cross-workspace model parameter form write
CVSS Score
7.4
EPSS Score
0.0%
EPSS Percentile
0th
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads and saves a Model by id alone without including workspace_id in the query. An authenticated user with model read permission in an attacker-controlled workspace can supply a known victim model_id to read or overwrite the victim's model_params_form in another workspace, potentially altering workflows that use those defaults. No fixed version is available as of this review.
| CWE | CWE-639 |
| Vendor | 1panel-dev |
| Product | maxkb |
| Published | Sep 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for 1panel-dev maxkb
Be the first to know when new high vulnerabilities affecting 1panel-dev maxkb are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
1Panel-dev / MaxKB
<= 2.10.3-lts