CyberRota Analysis
AI-GeneratedThe vulnerability exists in the retrieval endpoint of Chatbot UI, allowing authenticated attackers to bypass authorization and access private files belonging to other users by manipulating file UUIDs. This flaw arises from the use of a service-role Supabase client that neglects to enforce row-level security and validate file ownership, leading to potential data exposure. Organizations utilizing Chatbot UI should prioritize addressing this issue to protect sensitive user data from unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and fails to validate file ownership, enabling attackers to retrieve indexed content chunks from victim files through crafted POST requests.