Vulnerability · Published Apr 20, 2026 · Assigned by VulDB

CVE-2026-6588serge-chat serge Model API Endpoint model.py delete_model missing authentication

Medium 6.5

In plain English

A medium-severity missing authentication in serge from serge-chat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A weakness has been identified in serge-chat serge up to 1.4TB. The impacted element is the function download_model/delete_model of the file api/src/serge/routers/model.py of the component Model API Endpoint. Executing a manipulation can lead to missing authentication. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products (as reported)

Vendor	Product	Versions
serge-chat	serge	1.4TB

Weakness: CWE-306, CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R

References

VDB-358223 | serge-chat serge Model API Endpoint model.py delete_model missing authentication vdb-entry, technical-description
VDB-358223 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #791089 | serge-chat serge <= 3cb250c Missing Authentication for Critical Function (CWE-306) third-party-advisory
https://gist.github.com/YLChen-007/5fbc93a21f9928e91a72ab0d72fb1e88 exploit