CVE-2026-77937

HighCVSS 8.1/10Last modified Oct 20, 2026

Description

Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, to read and modify that user's agents, memory and configuration.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2026
Last modified: Oct 20, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-779386.5Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSa CVE-2026-779396.5Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API CVE-2026-779457.4A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05. Affected is an unknown function of the file /cgi-bin/upload.cgi of the component CVE-2026-7794610.0A vulnerability was determined in TRENDnet TEW-821DAP 2.2.01b05. Affected by this vulnerability is the function uci_safe_get of the file /cg CVE-2026-77956.4The Click to Chat – WA Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [chat] shortcode 'num' parameter in CVE-2026-779506.3Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_typescript allows an unauthenticated attacker CVE-2026-779554.4In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located be CVE-2026-779568.9Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execu CVE-2026-77966.4The EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more plugin for WordPress is vulnerable to Stor CVE-2026-779605.3Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subs CVE-2026-779668.8The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenti CVE-2026-779678.1The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association wit