CVE-2026-42337

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a broken access control vulnerability in the OSS file service URL fetch API (chat/api/oss/get_url). The endpoint uses application_id from the URL path without validating ownership, allowing attackers to perform operations under other applications’ policies. This vulnerability is fixed in 2.8.1.

• CWE-862

• https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-2jmj-gwvg-3gp2

Published

May 26, 2026

Last Modified

Jul 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4233A vulnerability was identified in ThingsGateway 12. This aff…4.3
• CVE-2026-42331FOSSBilling is a free, open-source billing and client manage…7.7
• CVE-2026-42333Quarkus OpenAPI Generator is Quarkus' extensions for generat…6.3
• CVE-2026-42334Mongoose is a MongoDB object modeling tool designed to work …7.5
• CVE-2026-42335MaxKB is an open-source AI assistant for enterprise. Prior t…6.3
• CVE-2026-42336MaxKB is an open-source AI assistant for enterprise. MaxKB 2…5.1
• CVE-2026-42338ip-address is a library for parsing and manipulating IPv4 an…6.1
• CVE-2026-42339New API is a large language mode (LLM) gateway and artificia…7.1
• CVE-2026-4234A security flaw has been discovered in SSCMS 7.4.0. This vul…6.3
• CVE-2026-42341FOSSBilling is a free, open-source billing and client manage…9.2
• CVE-2026-42342React Router is a router for React. In versions 7.0.0 throug…7.5
• CVE-2026-42343FastGPT is an AI Agent building platform. In versions 4.14.1…6.3