CVE-2026-85669
potpie through 2.0.0 Missing Ownership Check via code-changes sync
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending changes.
| CWE | CWE-862 |
| Vendor | potpie-ai |
| Product | potpie |
| Published | Sep 4, 2026 |
| Last Updated | Sep 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for potpie-ai potpie
Be the first to know when new medium vulnerabilities affecting potpie-ai potpie are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
potpie-ai / potpie
0 ≤ 2.0.0
References
github.com: https://github.com/potpie-ai/potpie/issues/870 github.com: https://github.com/potpie-ai/potpie github.com: https://github.com/potpie-ai/potpie/blob/v2.0.0/legacy/app/modules/conversations/conversations_router.py vulncheck.com: https://www.vulncheck.com/advisories/potpie-through-2.0.0-missing-ownership-check-via-code-changes-sync
Credits
George Chen