PYSEC-2026-1238
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/chainlit/PYSEC-2026-1238.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1238
- Aliases
- Published
- 2026-07-07T16:03:18.754455Z
- Modified
- 2026-07-07T17:47:24.610200544Z
- Severity
-
- 4.2 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Chainlit contains an authorization bypass vulnerability
- Details
-
Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be viewed or thread ownership may be obtained by an attacker who can log in to the product.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2025-68492
- https://github.com/Chainlit/chainlit/pull/2637
- https://github.com/Chainlit/chainlit/commit/8f1153db439eca58ae5c50c8276ba6fdd311448e
- https://github.com/Chainlit/chainlit
- https://github.com/Chainlit/chainlit/releases
- https://github.com/Chainlit/chainlit/releases/tag/2.8.5
- https://jvn.jp/en/jp/JVN34964581
- https://pypi.org/project/chainlit
- https://github.com/advisories/GHSA-v492-6xx2-p57g
Affected packages
PyPI / chainlit
Package
- Name
- chainlit
- View open source insights on deps.dev
- Purl
- pkg:pypi/chainlit
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.8.5
Affected versions
0.*
0.1.0
0.1.1
0.1.101
0.1.102
0.1.103
0.2.0
0.2.1
0.2.101
0.2.102
0.2.103
0.2.104
0.2.105
0.2.106
0.2.107
0.2.108
0.2.109
0.2.110
0.2.111
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.101
0.5.0
0.5.1
0.5.2
0.6.0
0.6.1
0.6.2
0.6.3
0.6.4
0.6.401
0.6.402
0.7.0
0.7.1
0.7.2
0.7.3
0.7.301
0.7.400
0.7.500
0.7.501
0.7.600rc0
0.7.600rc1
0.7.601rc0
0.7.602rc0
0.7.602
0.7.603
0.7.604rc0
0.7.604rc1
0.7.604rc2
0.7.604
0.7.700
1.*
1.0.0rc0
1.0.0rc1
1.0.0rc2
1.0.0rc3
1.0.0
1.0.100
1.0.101
1.0.200
1.0.300
1.0.301
1.0.400
1.0.401
1.0.500
1.0.501
1.0.502
1.0.503
1.0.504
1.0.505
1.0.506
1.1.0rc0
1.1.0rc1
1.1.0
1.1.101
1.1.200
1.1.201
1.1.202
1.1.300rc0
1.1.300rc1
1.1.300rc2
1.1.300rc3
1.1.300rc4
1.1.300rc5
1.1.300
1.1.301
1.1.302
1.1.303
1.1.304
1.1.305
1.1.306
1.1.400rc0
1.1.400rc1
1.1.400
1.1.401
1.1.402
1.1.403rc0
1.1.404
1.2.0rc0
1.2.0
1.3.0rc0
1.3.0rc1
1.3.0
1.3.1
1.3.2
2.*
2.0.dev0
2.0.dev1
2.0.dev2
2.0rc0
2.0rc1
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.601
2.0.602
2.0.603
2.1.0
2.1.1
2.1.2
2.2.0
2.2.1
2.3.0
2.4.0rc0
2.4.0
2.4.1
2.4.2
2.4.3
2.4.201
2.4.301
2.4.302
2.4.400
2.5.5
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.1
2.7.1.1
2.7.2
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4