{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-111702/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:chatollama:chatollama:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111702"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ChatOllama (\u003c= 96c3ce5)"],"_cs_severities":["high"],"_cs_tags":["web-application-vulnerability","idor","cve-2026-111702"],"_cs_type":"advisory","_cs_vendors":["ChatOllama"],"content_html":"\u003cp\u003eChatOllama through commit 96c3ce5 is affected by an insecure direct object reference (IDOR) vulnerability, tracked as CVE-2026-111702. This vulnerability allows remote, unauthenticated attackers to bypass authorization controls and access private knowledge bases stored within the application. By providing sequential numerical identifiers to the API, an attacker can enumerate and retrieve sensitive metadata and the content of documents associated with other users' knowledge bases. The vulnerability resides in how the application processes the {id} parameter in GET requests to the knowledgebase endpoint and the knowledgebaseId parameter in POST requests to the chat model interface. Given that these endpoints are typically exposed for API interaction, this flaw poses a significant risk to the confidentiality of organizational data processed by the ChatOllama platform.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to unauthorized access and exfiltration of sensitive information stored within ChatOllama knowledge bases. As knowledge bases often contain internal documentation, private datasets, or proprietary information, this exposure can result in significant data breaches, potential compliance violations, and loss of intellectual property. Since the identifiers are sequential, an attacker can systematically scrape the entire knowledge base repository of an instance without requiring specific knowledge of existing IDs.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate ChatOllama installations to a version beyond commit 96c3ce5 once a security patch is provided by the vendor. In the interim, implement strict network-level access controls for the /api/knowledgebases and /api/models/chat endpoints to restrict traffic to known, trusted internal IP ranges.\u003c/p\u003e\n\u003ch2 id=\"detection\"\u003eDetection\u003c/h2\u003e\n\u003cp\u003eBecause this vulnerability relies on sequential ID enumeration, detection teams should monitor web access logs for anomalous spikes in 200 OK responses from the /api/knowledgebases/ endpoint, specifically looking for high counts of distinct requested IDs originating from a single source IP.\u003c/p\u003e\n","date_modified":"2026-10-16T18:50:55Z","date_published":"2026-10-16T18:50:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-chatollama-idor/","summary":"ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to access private knowledge bases by enumerating sequential ID values.","title":"CVE-2026-111702: Insecure Direct Object Reference in ChatOllama","url":"https://feed.craftedsignal.io/briefs/2026-10-chatollama-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-111702","version":"https://jsonfeed.org/version/1.1"}