{"id":"CVE-2026-121558","kind":"vulnerability","aliases":["CVE-2026-121558"],"related":[],"title":"AuditPilot: authorization bypass lets users read other projects' knowledge","description":"AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/query or POST /api/research/answer to retrieve same-tenant project knowledge chunks.","summary":"AuditPilot before commit 4669c93 has a flaw in rag/agentic_rag.py where the project check does not hold, so a user can pass another project's ID. An authenticated user with read access to one project can retrieve knowledge chunks from other projects in the same tenant.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["auditpilot","multi-tenant","package","rag"],"not_affected_if":["commit-4669c93-or-later","single-project"],"how_to_check":"- Check whether the AuditPilot deployment is built from a commit before `4669c93`\n- Look for `_metadata_allowed` in `rag/agentic_rag.py` and confirm it validates `project_id` against the caller's allowed projects","fix":"- Move to a commit at or after `4669c93`","status":"open","published_at":"2026-11-03T16:17:28+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","triaged_at":"2026-11-03T16:24:24+00:00","updated_at":"2026-11-03T16:24:24+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:24:24Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a commit at or after `4669c93`","reach":"network","title":"AuditPilot: authorization bypass lets users read other projects' knowledge","impact":"medium","summary":"AuditPilot before commit 4669c93 has a flaw in rag/agentic_rag.py where the project check does not hold, so a user can pass another project's ID. An authenticated user with read access to one project can retrieve knowledge chunks from other projects in the same tenant.","audience":"businesses","category":"package","nicknames":[],"who_cares":["auditpilot","rag","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated users read other projects' knowledge chunks in the same tenant","analyst_note":"","how_to_check":"- Check whether the AuditPilot deployment is built from a commit before `4669c93`\n- Look for `_metadata_allowed` in `rag/agentic_rag.py` and confirm it validates `project_id` against the caller's allowed projects","plain_action":"","needs_analyst":false,"not_affected_if":["single-project","commit-4669c93-or-later"],"who_is_affected":"Deployments of AuditPilot built before commit 4669c93 that expose the knowledge query or research answer endpoints to users with read:knowledge scope on a project. Users limited to a single project within a shared tenant are the ones who can cross into other projects' data. Single-project deployments or instances without multi-project tenants have little exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000697,"input_tokens":4203,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121558':12A,15A '-2026':11A,14A '/api/knowledge/query':108C '/api/research/answer':111C '4669c93':25B,70C 'access':52B 'allow':78C,82C 'anoth':43B 'attack':94C 'auditpilot':1A,16B,22B,67C 'authent':48B,83C 'author':2A,73C 'bypass':3A,74C 'check':34B 'chunk':59B,119C 'commit':24B,69C 'contain':71C 'context.project':104C 'cve':10A,13A 'flaw':28B 'get':107C 'hold':37B 'id':46B,93C,105C 'knowledg':9A,58B,89C,97C,118C 'let':4A 'metadata':77C 'multi':18B 'multi-ten':17B 'one':54B,100C 'packag':20B 'pass':42B 'post':110C 'project':8A,33B,44B,55B,62B,88C,92C,101C,117C 'rag':21B 'rag/agentic_rag.py':30B,80C 'read':6A,51B,86C,96C 'retriev':57B,113C 'same-ten':114C 'scope':98C 'set':103C 'suppli':91C 'tenant':19B,66B,116C 'user':5A,40B,49B,84C 'via':106C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"Deployments of AuditPilot built before commit 4669c93 that expose the knowledge query or research answer endpoints to users with read:knowledge scope on a project. Users limited to a single project within a shared tenant are the ones who can cross into other projects' data. Single-project deployments or instances without multi-project tenants have little exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["auditpilot","medium","multitenant","package","rag"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:28+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121558","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121558","severity":null,"published_at":"2026-11-03T16:17:28+00:00","modified_at":"2026-11-03T16:17:28+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","fetched_at":"2026-11-03T16:21:44+00:00","note":null}],"documents":[{"id":58850,"url":"https://github.com/Ricky-7-Yan/intelligent-audit-system/commit/4669c93f3a7403a0e242bef14d771beef0b4356b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58851,"url":"https://www.vulncheck.com/advisories/auditpilot-before-commit-4669c93-rag-project-scope-authorization-bypass-via-project-id","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}