CVE-2026-82290 — Chainlit Feedback Endpoints Missing Ownership Validation
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supply…
Published: 2026-08-28 · CVSS: 6.0 · CVSS 4.0
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7