CVE-2026-23875

CrawlChat is an open-source, AI-powered platform that transforms technical documentation into intelligent chatbots. Prior to version 0.0.8, a non-existing permission check for the CrawlChat's Discord bot allows non-manage guild users to put malicious content onto the collection knowledge base. Usually, admin / mods of a Discord guild use the `jigsaw` emoji to save a specific message (chain) onto the collection's knowledge base of CrawlChat. Unfortunately an permission check (for e.g. MANAGE_SERVER; MANAGE_MESSAGES etc.) was not done, allowing normal users of the guild to information to the knowledge base. With targeting specific parts that are commonly asked, users can manipulate the content given out by the bot (on all integrations), to e.g. redirect users to a malicious site, or send information to a malicious user. Version 0.0.8 patches the issue.

• CWE-862

• https://github.com/crawlchat/crawlchat/commit/f90ebb93c6a830f6cf609d683f6425af8434573aPatch
• https://github.com/crawlchat/crawlchat/releases/tag/v0.0.8Product, Release Notes
• https://github.com/crawlchat/crawlchat/security/advisories/GHSA-f484-62p4-6w4pExploit, Vendor Advisory

Published

Jan 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-23868Giflib contains a double-free vulnerability that is the resu…5.1
• CVE-2026-23869A denial of service vulnerability exists in React Server Com…7.5
• CVE-2026-2387The Event Organiser plugin for WordPress is vulnerable to St…6.4
• CVE-2026-23870A denial of service vulnerability could be triggered by send…7.5
• CVE-2026-23873hustoj is an open source online judge based on PHP/C++/MySQL…9
• CVE-2026-23874ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-23876ImageMagick is free and open-source software used for editin…9.8
• CVE-2026-23877Swing Music is a self-hosted music player for local audio fi…4.3
• CVE-2026-23878HotCRP is conference review software. Starting in commit aa2…6.5
• CVE-2026-23879py7zr is a Python-based library and utility to support 7zip …8
• CVE-2026-23880OnboardLite is a comprehensive membership lifecycle platform…7.3
• CVE-2026-23881Kyverno is a policy engine designed for cloud native platfor…6.5