CVE-2026-85669: potpie through 2.0.0 Missing Ownership Check via code-changes sync

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-04 · updated 2026-09-10
Weakness: CWE-862

Description

potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending changes.

Affected products

potpie-ai potpie: through 2.0.0

References

https://github.com/potpie-ai/potpie
https://github.com/potpie-ai/potpie/blob/v2.0.0/legacy/app/modules/conversations/conversations_router.py
https://github.com/potpie-ai/potpie/issues/870
https://www.vulncheck.com/advisories/potpie-through-2.0.0-missing-ownership-check-via-code-changes-sync

Get alerted when CVE-2026-85669 or the next vulnerability affects your stack