CVE-2026-82290

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation.

  • Published Aug 28, 2026
  • CVSS 6.0 medium
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-82290 at the National Vulnerability Database