Improper Ownership Validation in Chainlit Application by Chainlit

CVE-2026-82290

What is CVE-2026-82290?

In the Chainlit application versions up to 2.12.0, an improper validation of ownership in PUT and DELETE API endpoints allows authenticated attackers to manipulate feedback records. This vulnerability enables them to delete or modify feedback belonging to other users by providing arbitrary identifiers, potentially corrupting the human-rating data essential for model evaluation. Such a flaw emphasizes the importance of robust ownership verification mechanisms to safeguard user-generated content.

References