CVE-2026-85093

Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when returning episodic memory points, an incorrect-authorization flaw (CWE-863). An authenticated user holding MEMORY:READ permission can call the endpoint and page through the collection with the offset cursor, bypassing user scoping entirely. This grants the attacker read access to all users' stored conversation messages and any personal data in that collection; CVSS 4.0 scores the confidentiality impact as high with no integrity or availability effects (7.1). Any deployment of the open-source, self-hosted Cheshire Cat AI agent framework where multiple users hold accounts with MEMORY:READ on the same instance is affected, while single-user deployments gain the attacker little. No public proof-of-concept is known, the issue is not in CISA KEV, and EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

What to do: Update to a fixed release when published (no fixed version number is available in the current data) and monitor the Cheshire Cat AI GitHub repository or vendor advisory for the patch. Until then, restrict MEMORY:READ to trusted users, limit internet exposure of the /memory/collections endpoints, and review access logs for unusual offset-based pagination by low-privilege accounts. Operators of multi-user instances should confirm whether other users' conversation data was exposed; single-user deployments are minimally impacted.