{"id":"CVE-2026-111702","kind":"vulnerability","aliases":["CVE-2026-111702"],"related":[],"title":"ChatOllama: sequential ids let users read other users' private knowledge bases","description":"ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.","summary":"ChatOllama's GET /api/knowledgebases/{id} and POST /api/models/chat (knowledgebaseId) skip the ownership check that the update and delete routes use (requireKnowledgeBaseOwner). Ids are sequential integers, so any caller can enumerate other users' private knowledge bases: metadata via the GET route, ingested document text via the chat route's relevant_docs. KNOWLEDGE_BASE_ENABLED=true ships in .env.example. The researcher says a normal logged-in account is enough; the CVE scores it as no privileges required. No patched release is published.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"chat-ollama","fixed":[],"affected":"<= 96c3ce50c3ba4ec3b19f126f50c035f84183f9fc","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","chatollama","idor","knowledge-base","multi-user","self-hosted"],"not_affected_if":["knowledge-base-disabled","no-knowledge-bases","single-user","single-user-deployment"],"how_to_check":"Run a self-hosted ChatOllama at or before commit 96c3ce50c3ba4ec3b19f126f50c035f84183f9fc (tag agent-v0.4.0 is 6f4245a) with KNOWLEDGE_BASE_ENABLED=true (check .env)? Then you are exposed. Test with a second non-owner account: GET /api/knowledgebases/<id of another user's private KB>. If it returns the record instead of 403, you are vulnerable. Check server/api/knowledgebases/[id].get.ts and server/api/models/chat/index.post.ts for a requireKnowledgeBaseOwner call.","fix":"No fixed version or commit found as of 2026-10-23. Mitigate: set KNOWLEDGE_BASE_ENABLED=false, or do not expose the instance beyond trusted users, or put authentication in front of /api/knowledgebases and /api/models/chat. Or patch locally by calling requireKnowledgeBaseOwner (or checking is_public/user_id) in the two handlers. Watch sugarforever/chat-ollama for a fix.","status":"open","published_at":"2026-10-16T18:17:54+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:37:37+00:00","updated_at":"2026-10-23T22:38:36+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:37:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ChatOllama: sequential ids let users read other users' private knowledge bases","impact":"high","summary":"ChatOllama does not check ownership of knowledge base ids, so a remote attacker who guesses sequential ids can read other users' knowledge base metadata. They can also read retrieved document content through the chat endpoint.","category":"ai-tooling","who_cares":["chatollama","self-hosted","multi-user"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker reads other users' private documents and knowledge base metadata","analyst_note":"Check the NVD entry and the ChatOllama repo for a fixed commit after 96c3ce5 and whether the attack needs an account (the sources do not say).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["single-user-deployment","no-knowledge-bases"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00047,"input_tokens":2938,"output_tokens":353,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the ChatOllama repo for a fixed commit after 96c3ce5 and whether the attack needs an account (the sources do not say).","search":"'-111702':14A,17A '-2026':13A,16A '/api/knowledgebases':38B,148C '/api/models/chat':42B,156C '96c3ce5':119C 'access':132C 'account':100B 'ai':22B 'ai-tool':21B 'allow':128C 'attack':130C,142C 'base':11A,28B,69B,86B,137C 'caller':62B 'chat':19A,80B 'chat-ollama':18A 'chatollama':1A,24B,35B,116C 'check':47B 'commit':118C 'contain':120C 'content':163C 'cve':12A,15A,104B 'delet':52B 'direct':123C 'doc':84B 'document':76B,162C 'enabl':87B 'enough':102B 'enumer':64B,144C 'env.example':91B 'get':37B,73B,147C 'host':34B 'id':3A,39B,56B,141C,145C,149C 'idor':25B 'ingest':75B 'insecur':122C 'integ':59B 'knowledg':10A,27B,68B,85B,136C 'knowledge-bas':26B 'knowledgebaseid':43B,152C 'let':4A 'log':98B 'logged-in':97B 'metadata':70B,159C 'multi':30B 'multi-us':29B 'normal':96B 'object':124C 'ollama':20A 'ownership':46B 'paramet':153C 'patch':112B 'post':41B,155C 'privat':9A,67B,135C 'privileg':109B 'publish':115B 'read':6A,158C 'refer':125C 'releas':113B 'relev':83B 'remot':129C 'requir':110B 'requireknowledgebaseown':55B 'research':93B 'retriev':161C 'rout':53B,74B,81B 'say':94B 'score':105B 'self':33B 'self-host':32B 'sequenti':2A,58B,140C 'ship':89B 'skip':44B 'suppli':139C 'text':77B 'tool':23B 'true':88B 'updat':50B 'use':54B 'user':5A,8A,31B,66B,134C 'via':71B,78B,146C 'vulner':126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-111702","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111702","severity":null,"published_at":"2026-10-16T18:17:54+00:00","modified_at":"2026-10-16T19:17:05+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111702:267","url":null,"severity":null,"published_at":"2026-10-23T22:38:36+00:00","modified_at":"2026-10-23T22:38:36+00:00","first_seen_at":"2026-10-23T22:38:36+00:00","fetched_at":"2026-10-23T22:38:36+00:00","note":"Read researcher writeup (hackmd), VulnCheck, GHSA, cve.org. Needs a normal account per researcher (static review, not runtime-tested); NVD/CVSS says PR:N and handlers add no auth, so unauthenticated is possible if no front-door auth. No fix: repo main still ends at 96c3ce5 (Sep 11) and GHSA lists no patched version. No in-the-wild exploitation found; researcher writeup is the only PoC (illustrative requests, not executed). Did not search X/HN."}],"documents":[{"id":1548,"url":"https://hackmd.io/@hieuPenguinnn/chat-ollama-knowledge-base-cross-user-idor","title":"ChatOllama cross-user knowledge base disclosure (hieuPenguinnn)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1549,"url":"https://www.vulncheck.com/advisories/chatollama-through-commit-96c3ce5-idor-exposes-private-knowledge-bases","title":"VulnCheck: ChatOllama IDOR","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1550,"url":"https://github.com/advisories/GHSA-7pf8-cp62-gc3p","title":"GHSA-7pf8-cp62-gc3p (no patched version listed)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}