CVE-2026-82290: Chainlit Feedback Endpoints Missing Ownership Validation

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-09-16
Weakness: CWE-639

Description

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.

Affected products

chainlit: through 2.12.0

References

https://github.com/Chainlit/chainlit
https://github.com/Chainlit/chainlit/blob/190ea74239d9e84b26e7c91bc2882dd038942564/backend/chainlit/server.py
https://github.com/Chainlit/chainlit/issues/2975
https://www.vulncheck.com/advisories/chainlit-feedback-endpoints-missing-ownership-validation
https://github.com/Chainlit/chainlit/issues/2975

Get alerted when CVE-2026-82290 or the next vulnerability affects your stack