Insecure Direct Object Reference in ChatOllama by SugarForever

CVE-2026-111702

What is CVE-2026-111702?

ChatOllama, in a specific commit, is affected by an insecure direct object reference vulnerability that permits unauthorized access to users' private knowledge bases. By manipulating sequential IDs, an attacker can effectively enumerate these IDs through APIs, namely GET /api/knowledgebases/{id} and POST /api/models/chat, leading to exposure of sensitive document content and metadata. This flaw necessitates immediate attention to safeguard user data.

References