Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 04 Nov 2026 18:16:38 +0000 CVE-2026-121558 — AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id https://db.gcve.eu/vuln/cve-2026-121558 <p><strong>Affected:</strong> Ricky-7-Yan intelligent-audit-system</p> <p>AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects&#39; knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/query or POST /api/research/answer to retrieve same-tenant project knowledge chunks.</p> <p><strong>Affected:</strong> Ricky-7-Yan intelligent-audit-system</p> <p>AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects&#39; knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/query or POST /api/research/answer to retrieve same-tenant project knowledge chunks.</p> https://db.gcve.eu/vuln/cve-2026-121558