JVN#34964581
Chainlit vulnerable to improper access restriction

Overview

Chainlit provided by Chainlit contains an improper access restriction vulnerability.

Products Affected

• Chainlit versions prior to 2.8.5

Description

Chainlit provided by Chainlit contains the following vulnerability.

• Authorization bypass through user-controlled key (CWE-639)
  • CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 2.3
  • CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N Base Score 4.2
  • CVE-2025-68492

Impact

Threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.