cve.bz

CVE-2026-82290

6.0 mediumEPSS 0.3%

Medium (6.0). EPSS 0.3% chance of exploitation in the next 30 days.

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.

Severity

CVSS 4.0

6.0 medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE
CWE-639
Published
Modified
Record from
the NVD, synced

References

Check your stackJSON