---
id: "CVE-2026-111702"
kind: "vulnerability"
aliases: ["CVE-2026-111702"]
title: "ChatOllama: sequential ids let users read other users' private knowledge bases"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "chat-ollama", "fixed": [], "affected": "<= 96c3ce50c3ba4ec3b19f126f50c035f84183f9fc", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-tooling", "chatollama", "idor", "knowledge-base", "multi-user", "self-hosted"]
not_affected_if: ["knowledge-base-disabled", "no-knowledge-bases", "single-user", "single-user-deployment"]
published_at: "2026-10-16T18:17:54+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T22:38:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111702", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:38:36+00:00"}]
---

# ChatOllama: sequential ids let users read other users' private knowledge bases

ChatOllama's GET /api/knowledgebases/{id} and POST /api/models/chat (knowledgebaseId) skip the ownership check that the update and delete routes use (requireKnowledgeBaseOwner). Ids are sequential integers, so any caller can enumerate other users' private knowledge bases: metadata via the GET route, ingested document text via the chat route's relevant_docs. KNOWLEDGE_BASE_ENABLED=true ships in .env.example. The researcher says a normal logged-in account is enough; the CVE scores it as no privileges required. No patched release is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:chat-ollama affected <= 96c3ce50c3ba4ec3b19f126f50c035f84183f9fc fixed ?

## How to check

Run a self-hosted ChatOllama at or before commit 96c3ce50c3ba4ec3b19f126f50c035f84183f9fc (tag agent-v0.4.0 is 6f4245a) with KNOWLEDGE_BASE_ENABLED=true (check .env)? Then you are exposed. Test with a second non-owner account: GET /api/knowledgebases/<id of another user's private KB>. If it returns the record instead of 403, you are vulnerable. Check server/api/knowledgebases/[id].get.ts and server/api/models/chat/index.post.ts for a requireKnowledgeBaseOwner call.

## Fix

No fixed version or commit found as of 2026-10-23. Mitigate: set KNOWLEDGE_BASE_ENABLED=false, or do not expose the instance beyond trusted users, or put authentication in front of /api/knowledgebases and /api/models/chat. Or patch locally by calling requireKnowledgeBaseOwner (or checking is_public/user_id) in the two handlers. Watch sugarforever/chat-ollama for a fix.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111702
- 2026-10-23T22:38:36+00:00 analyst — Read researcher writeup (hackmd), VulnCheck, GHSA, cve.org. Needs a normal account per researcher (static review, not runtime-tested); NVD/CVSS says PR:N and handlers add no auth, so unauthenticated is possible if no front-door auth. No fix: repo main still ends at 96c3ce5 (Sep 11) and GHSA lists no patched version. No in-the-wild exploitation found; researcher writeup is the only PoC (illustrative requests, not executed). Did not search X/HN.

## Documents

- [advisory] VulnCheck: ChatOllama IDOR https://www.vulncheck.com/advisories/chatollama-through-commit-96c3ce5-idor-exposes-private-knowledge-bases
- [advisory] GHSA-7pf8-cp62-gc3p (no patched version listed) https://github.com/advisories/GHSA-7pf8-cp62-gc3p
- [poc] ChatOllama cross-user knowledge base disclosure (hieuPenguinnn) https://hackmd.io/@hieuPenguinnn/chat-ollama-knowledge-base-cross-user-idor

## From the sources

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} or the knowledgebaseId parameter of POST /api/models/chat to read metadata and retrieved document content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_