CVE-2026-77523

Executive Summary

CVE-2026-77523 is an authorization bypass (CWE-639) in MaxKB, an open-source enterprise AI assistant, affecting version 2.10.3-lts and earlier. An authenticated user holding model read permission in one workspace can supply a model identifier belonging to a different workspace and cause the application to load or overwrite the victim's model parameter configuration without verifying workspace ownership. Impact is cross-tenant configuration tampering that can alter AI workflow defaults, rated CVSS 7.4 with a Scope:Changed vector reflecting the boundary crossing between workspaces.

Technical Analysis

The vulnerability resides in the model parameter form handling path of MaxKB. According to the NVD description, the model parameter form route performs authorization against the path workspace, but the ModelSerializer.ModelParams component loads and saves a Model object by id alone, without including workspace_id in the database query. This creates a mismatch between the authorization check (which validates the caller against the workspace named in the request path) and the object retrieval (which resolves the model solely from the attacker-supplied model_id).

The result is a classic insecure direct object reference combined with broken object-level authorization, mapped to CWE-639 (Authorization Bypass Through User-Controlled Key). Because the object lookup does not scope by workspace, any model_id that exists anywhere in the installation is reachable provided the caller passes the coarse-grained authorization check for their own workspace. An authenticated attacker with model read permission in their own, attacker-controlled workspace therefore satisfies the permission gate while operating on a foreign object.

The read path allows exfiltration of another workspace's model_params_form — the stored default parameter configuration for a model. The write path allows that configuration to be overwritten. No public proof-of-concept, Nuclei template, or exploit code is available, and no fixed version exists as of this review, so the attack chain below is described strictly at the vulnerability-class level.

Preconditions for exploitation, derived from the CVSS vector (PR:L, AV:N, UI:N):

• Valid authenticated account on the target MaxKB instance.
• Model read permission within at least one workspace the attacker controls.
• Knowledge of a valid model_id belonging to the victim workspace (an identifier, not a secret credential).

The unaudited component boundary and the CWE-639 classification confirm this is an object-level authorization defect, not a memory-safety or injection flaw. There is no indication of pre-authentication reachability, remote code execution, or credential disclosure in the description provided.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class (CWE-639, IDOR/BOLA) and the mechanisms named in the NVD description.

1. Reconnaissance and target identification. The attacker authenticates to a MaxKB 2.10.3-lts (or earlier) instance with any low-privilege account, then enumerates model identifiers visible to that account and, where identifiers are sequential or otherwise guessable, infers valid model_id values belonging to other workspaces. Shodan-style discovery of internet-exposed MaxKB instances (http.title:"MaxKB") provides candidate targets.

2. Triggering the flaw. The attacker issues a request to the model parameter form route, naming their own workspace in the path so the route-level authorization check passes, while supplying a victim-owned model_id in the request body or parameters. Because ModelSerializer.ModelParams resolves the Model by id alone and omits workspace_id from the query, the workspace scoping applied to the path is never applied to the object fetch.

3. Read and/or write. On the read action, the response returns the victim workspace's model_params_form, disclosing configuration detail. On the save action, the same unscoped lookup persists attacker-supplied values into the victim's model_params_form, mutating defaults that are subsequently consumed by workflows in the victim workspace.

4. Post-exploitation impact. The attacker has no code execution primitive here. Impact is confined to cross-tenant configuration integrity and confidentiality within the MaxKB deployment: altered model defaults can change the behavior of AI workflows that rely on those defaults, degrade output quality, or introduce attacker-chosen parameters into downstream retrieval and generation pipelines.

Impact Assessment

Business impact centers on multi-tenant trust in a shared MaxKB deployment used as an enterprise AI assistant. The CVSS 3.1 vector scores 7.4 (High) with subscores Confidentiality:L, Integrity:L, Availability:L and Scope:Changed. The Scope:Changed component is material: it reflects that the vulnerable component's authorization boundary — the workspace — is crossed, so a principal legitimate in one workspace affects resources belonging to another. Low confidentiality impact corresponds to disclosure of model parameter configuration rather than secrets or model data; low integrity impact corresponds to modification of stored defaults; low availability impact corresponds to workflow degradation rather than hard outage.

Blast radius is a function of deployment topology. Self-hosted MaxKB instances with a single workspace have minimal cross-tenant exposure, though any authenticated user with model read permission could still read or overwrite parameters outside their intended scope. Multi-workspace or multi-tenant SaaS-style deployments carry the highest risk, since workspace isolation is the primary tenancy control and this flaw defeats it for the affected object type. Affected systems are all MaxKB installations at version 2.10.3-lts and earlier; no fixed version is available, so every deployment meeting those version constraints remains exposed until remediation is published.

Exploitability is moderate: network-reachable (AV:N), no user interaction required (UI:N), low attack complexity (AC:L), but gated on credentials and a model read permission (PR:L). EPSS has not yet been scored by FIRST.org, and CVE-2026-77523 is not listed in CISA KEV, so there is no evidence of exploitation in the wild at the time of writing.

Detection Guidance

Detection should focus on authenticated API requests to the MaxKB model parameter form route where the workspace named in the request path does not match the workspace that owns the referenced model_id. Because MaxKB logs are application- and access-log driven, correlation across request path, authenticated principal, and model_id is the pivot.

Sigma Rule

title: MaxKB Cross-Workspace Model Parameter Access (CVE-2026-77523)
id: 4f3c9b21-7a6e-4d2f-9c1b-maxkb77523
status: experimental
description: Detects requests to the MaxKB model parameter form route where the workspace in the path and the model_id in the request body do not correspond, indicative of CWE-639 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77523
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: maxkb
detection:
  selection_route:
    cs-uri-stem|contains:
      - '/model'
      - 'workspace'
  selection_params:
    cs-uri-query|contains|all:
      - 'workspace'
      - 'model_id'
  condition: selection_route and selection_params
falsepositives:
  - Legitimate administrative operations spanning multiple workspaces
  - Internal service accounts with delegated cross-workspace access
level: medium
tags:
  - attack.t1190
  - cve.2026.77523
  - cwe.639

YARA Rule

rule CVE_2026_77523_MaxKB_BOLA_Indicators
{
    meta:
        description = "Detects MaxKB artifacts or logs referencing cross-workspace model parameter access associated with CVE-2026-77523"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77523"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $kw1 = "ModelParams" ascii wide
        $kw2 = "model_params_form" ascii wide
        $kw3 = "workspace_id" ascii wide
        $kw4 = "model_id" ascii wide
        $kw5 = "MaxKB" ascii wide
        $cve = "CVE-2026-77523" ascii wide

    condition:
        (2 of ($kw1, $kw2, $kw3, $kw4)) or ($cve and $kw5)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-77523 MaxKB cross-workspace model parameter access attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"workspace"; http.uri; content:"model"; http.uri; content:"model_id"; http.header; content:"Authorization"; reference:cve,2026-77523; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-77523; classtype:attempted-user; sid:7752301; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [http where http.request.method in ("GET", "POST") and
     http.request.uri contains "workspace" and http.request.uri contains "model"]
  [http where http.request.body contains "model_id" and
     http.request.uri contains "workspace"]

Splunk SPL Query

index=web OR index=maxkb
| search (uri_path="*workspace*" AND uri_path="*model*")
| eval cross_workspace=if(match(uri_query, "workspace=\w+") AND match(uri_query, "model_id=\w+"), 1, 0)
| where cross_workspace=1
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_query) as queries by src_ip, user, uri_path
| where count > 3
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="maxkb,cve-2026-77523,">
  <rule id="775230" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.*workspace\.*model\.*</field>
    <description>CVE-2026-77523: Possible MaxKB cross-workspace model parameter access attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_77523,authorization_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. There is no vendor fix and no published workaround. Restrict network exposure of MaxKB instances so the API is not reachable from untrusted networks; place it behind an authenticating reverse proxy or VPN. Reduce the number of accounts holding model read permission, and audit which accounts can create attacker-controlled workspaces. Where the deployment architecture permits it, consolidate to a single workspace to eliminate the cross-workspace boundary this flaw crosses, or isolate tenants on separate MaxKB instances until a fix ships.

2. Patch/upgrade steps. No fixed version is available as of this review. Monitor the MaxKB project's release channels and the NVD entry for CVE-2026-77523 for an advisory and patched release. When a fix is published, upgrade all instances at or below 2.10.3-lts, then verify that model parameter form requests enforce workspace scoping on object retrieval, not only on the request path.

3. Long-term hardening. Enforce object-level authorization as a query invariant: every lookup of a workspace-scoped object must include workspace_id in the database filter rather than relying on route-level checks. Apply defense in depth with per-workspace row-level security or ORM-level tenant filters so a missing scope check cannot silently resolve foreign objects. Rate-limit and alert on model parameter read and write operations, log the authenticated principal alongside workspace and model identifiers for every such call, and include cross-tenant authorization bypass in code review checklists and regression tests for AI-platform APIs.

References

• NVD — CVE-2026-77523: https://nvd.nist.gov/vuln/detail/CVE-2026-77523
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MaxKB project repository and release notes (consult for patched version when published): https://github.com/1Panel-dev/MaxKB
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-77523 not listed as of this review): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template has been observed. CVE-2026-77523 is not listed in CISA KEV and EPSS has not yet scored it; no threat actor campaign or in-the-wild exploitation evidence is associated with this CVE at the time of writing.