CVE-2026-111702

HighCVSS 7.5/10Last modified Oct 16, 2026

Description

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2026
Last modified: Oct 16, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1117036.3yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other use CVE-2026-1117049.8LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST CVE-2026-1117054.3Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other memb CVE-2026-1117067.599AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated at CVE-2026-1117075.399AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' cha CVE-2026-1117089.8WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-reg CVE-2026-1117095.4WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to ac CVE-2026-111718.8Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-1117107.5Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allow CVE-2026-1117119.8Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, wh CVE-2026-1117126.5Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected CVE-2026-1117135.4tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while