CVE-2026-85669 — potpie through 2.0.0 Missing Ownership Check via code-changes sync
potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file cha…
Published: 2026-09-04 · CVSS: 7.1 · CVSS 4.0
potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write arbitrary file changes into other users' conversations by supplying their conversation IDs, allowing unauthorized modification of pending changes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7