CVE-2026-85093 — Cheshire Cat AI Memory Collection Endpoint Information Disclosure
Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with …
Published: 2026-09-03 · CVSS: 7.1 · CVSS 4.0
Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and personal data by paginating through the collection using the offset cursor.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7