CyberRota Analysis
AI-GeneratedThe vulnerability allows authenticated attackers to manipulate feedback records by exploiting the PUT and DELETE endpoints, enabling them to delete or modify feedback from other users. This can lead to the corruption of human-rating data critical for model evaluation, potentially impacting the integrity of machine learning models. Organizations using Chainlit versions up to 2.12.0 should prioritize patching this issue to safeguard their feedback systems and maintain data integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.