Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85693Chatbot UI Cross-User Private File Content Disclosure via Retrieval API

Medium 6.5

In plain English

A medium-severity authorization bypass via user-controlled key in chatbot-ui from mckaywrigley. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 61.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and fails to validate file ownership, enabling attackers to retrieve indexed content chunks from victim files through crafted POST requests.

Affected products (as reported)

Vendor	Product	Versions
mckaywrigley	chatbot-ui	0 – through 81328b61d2a4ab597a7a057be70e785cf756d9f8

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #2028 issue-tracking
https://github.com/mckaywrigley/chatbot-ui product
https://github.com/mckaywrigley/chatbot-ui/blob/81328b61d2a4ab597a7a057be70e785cf756d9f8/app/api/retrieval/retrieve/route.ts technical-description
VulnCheck Advisory: Chatbot UI Cross-User Private File Content Disclosure via Retrieval API third-party-advisory