Filtered by vendor Ricky-7-yan Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-121558 1 Ricky-7-yan 1 Intelligent-audit-system 2026-11-07 4.3 Medium
AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id. Attackers with read:knowledge scoped to one project can set context.project_id via GET /api/knowledge/query or POST /api/research/answer to retrieve same-tenant project knowledge chunks.