Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-77525
1Panel-dev MaxKB — MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id
AV AC PR UI S C I A CVSS EPSS %ile KEV
N H L N U L L N 4.2 .0019 8.3 —
AFFECTED
Product Versions Fixed
MaxKB <= 2.10.2-lts – —
TIMELINE
Aug 20 Reserved by GitHub_M
Sep 21 Published (CNA: GitHub_M)
Sep 24 EXPLOIT PUBLISHED — CVE-2026-77525 (1Panel-dev MaxKB). Public exploit reference added.
Description
MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using global chat_id and chat_record_id values without confirming that the chat belongs to the authorized application. A normal user in the same workspace who knows the chat_id of a persisted non-debug record for a victim's published application can place it under a separate attacker-owned application path to read victim chat records. An attacker with an owned knowledge base and document can also use add_knowledge to copy victim answers while updating the victim record's improve_paragraph_id_list. No fixed version is available as of this review.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| August 20, 2026 | Reserved | Reserved by GitHub_M |
| September 21, 2026 | Published | Published (CNA: GitHub_M) |
| September 24, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-77525 (1Panel-dev MaxKB). Public exploit reference added. |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| 1Panel-dev | MaxKB | — | <= 2.10.2-lts | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-77525 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
