CVE-2026-85693

Chatbot UI, an open-source chat interface, contains an authorization bypass (CWE-639) in its retrieval endpoint that lets any authenticated user read private file content belonging to other users. An attacker sends a crafted POST request to the retrieval endpoint with an arbitrary file UUID; the backend uses a service-role Supabase client that bypasses row-level security and never validates that the requested file belongs to the requester, returning indexed content chunks from the victim's files. The impact is confidentiality only — CVSS 4.0 rates it 7.1 (High) with high confidentiality loss and no integrity or availability impact — so an attacker gains read access to other users' uploaded file content. Anyone running a Chatbot UI deployment with multiple accounts sharing one database is affected, while single-user instances have little to lose. There is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns a 0.3% (16th percentile) 30-day exploitation probability, so exploitation is not currently observed.

What to do: Upgrade Chatbot UI to the patched release as soon as one is published (no fixed version was specified in the disclosure), and until then avoid exposing multi-user instances to untrusted or broadly assigned accounts. As an interim mitigation, scope retrieval queries to the authenticated user's session so Supabase row-level security applies rather than relying on the service-role client, and audit other endpoints for the same pattern of service-role access without ownership checks. Review access logs for POST requests to the retrieval endpoint referencing file UUIDs that the requesting user does not own, which would indicate probing or abuse.